6f854d2bad8aaa5d74c5f2ebcf102eb12c17c18494d9691c56820eb6bc02f068

Analysis

max time kernel
120s
max time network
117s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/09/2024, 21:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

49e45d83f5e0ba26d8e947a594cf4ac0N.exe
Size

468KB
MD5

49e45d83f5e0ba26d8e947a594cf4ac0
SHA1

9a3c0a004923e5a6e99d0b68d58f90cda9ef7114
SHA256

6f854d2bad8aaa5d74c5f2ebcf102eb12c17c18494d9691c56820eb6bc02f068
SHA512

c850051216e1bbb113767efaccc7c3d1b297d16f513d652756e291d76bd744877128a5caf5b6555d2f9eaf0ee00216c816a9561c03a131cc0e1f43fc8507b5d8
SSDEEP

3072:WqbCo7L+jy85BbY3Pz5jofLOCnjWIpP5mHegVCg4pIFj5zNANlm:WquoiL5BkP1jofy07g4p4lzNA

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1936	Unicorn-50459.exe
4312	Unicorn-35083.exe
3772	Unicorn-11133.exe
4076	Unicorn-46409.exe
4484	Unicorn-23851.exe
372	Unicorn-38795.exe
1532	Unicorn-13636.exe
4844	Unicorn-38023.exe
3984	Unicorn-28271.exe
4748	Unicorn-56305.exe
2896	Unicorn-21495.exe
3136	Unicorn-46746.exe
2356	Unicorn-60481.exe
4544	Unicorn-809.exe
4612	Unicorn-2781.exe
1840	Unicorn-15547.exe
4436	Unicorn-41121.exe
1172	Unicorn-21255.exe
1176	Unicorn-20408.exe
5068	Unicorn-6118.exe
5016	Unicorn-6118.exe
5040	Unicorn-9387.exe
1540	Unicorn-59979.exe
2700	Unicorn-59979.exe
2316	Unicorn-23122.exe
4036	Unicorn-22154.exe
3756	Unicorn-399.exe
3108	Unicorn-46336.exe
2988	Unicorn-34712.exe
4904	Unicorn-36928.exe
4480	Unicorn-26713.exe
3240	Unicorn-7270.exe
4104	Unicorn-57047.exe
1076	Unicorn-49948.exe
2464	Unicorn-50825.exe
2136	Unicorn-28075.exe
1544	Unicorn-4125.exe
812	Unicorn-17860.exe
2216	Unicorn-62563.exe
2232	Unicorn-62563.exe
228	Unicorn-18271.exe
2880	Unicorn-23690.exe
4680	Unicorn-37011.exe
4924	Unicorn-2200.exe
4880	Unicorn-14452.exe
4676	Unicorn-27774.exe
3284	Unicorn-31343.exe
1196	Unicorn-51209.exe
4356	Unicorn-5115.exe
1536	Unicorn-5115.exe
4184	Unicorn-56917.exe
3520	Unicorn-51317.exe
2792	Unicorn-11245.exe
4852	Unicorn-56362.exe
2572	Unicorn-49818.exe
1060	Unicorn-11245.exe
412	Unicorn-63139.exe
3080	Unicorn-12049.exe
1124	Unicorn-64837.exe
3420	Unicorn-40794.exe
1644	Unicorn-19305.exe
384	Unicorn-50835.exe
3148	Unicorn-45947.exe
4124	Unicorn-9553.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
14860	12740	WerFault.exe	645

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9620.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59913.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-399.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8603.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6820.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42957.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40025.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63150.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48211.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27546.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15485.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13622.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18225.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50825.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9014.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45610.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59913.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17349.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27902.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-399.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31125.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37115.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42433.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9014.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32136.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18553.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31721.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15485.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45323.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53264.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13347.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37115.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14141.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19410.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22154.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48625.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41971.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20286.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10393.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16855.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9620.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27027.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53420.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47811.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34124.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16855.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56636.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18811.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12013.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43009.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17841.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61859.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18427.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8336.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41609.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29684.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10650.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18271.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49948.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18880.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51209.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47661.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44001.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56680.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	1032	dwm.exe
Token: SeChangeNotifyPrivilege	1032	dwm.exe
Token: 33	1032	dwm.exe
Token: SeIncBasePriorityPrivilege	1032	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3812	49e45d83f5e0ba26d8e947a594cf4ac0N.exe
1936	Unicorn-50459.exe
4312	Unicorn-35083.exe
3772	Unicorn-11133.exe
4076	Unicorn-46409.exe
372	Unicorn-38795.exe
4484	Unicorn-23851.exe
1532	Unicorn-13636.exe
4844	Unicorn-38023.exe
3984	Unicorn-28271.exe
3136	Unicorn-46746.exe
2896	Unicorn-21495.exe
4748	Unicorn-56305.exe
2356	Unicorn-60481.exe
4544	Unicorn-809.exe
4612	Unicorn-2781.exe
1840	Unicorn-15547.exe
4436	Unicorn-41121.exe
1172	Unicorn-21255.exe
1176	Unicorn-20408.exe
5068	Unicorn-6118.exe
1540	Unicorn-59979.exe
2700	Unicorn-59979.exe
2988	Unicorn-34712.exe
4036	Unicorn-22154.exe
2316	Unicorn-23122.exe
5016	Unicorn-6118.exe
3108	Unicorn-46336.exe
3756	Unicorn-399.exe
5040	Unicorn-9387.exe
4904	Unicorn-36928.exe
4480	Unicorn-26713.exe
3240	Unicorn-7270.exe
4104	Unicorn-57047.exe
1076	Unicorn-49948.exe
2464	Unicorn-50825.exe
2136	Unicorn-28075.exe
1544	Unicorn-4125.exe
812	Unicorn-17860.exe
2232	Unicorn-62563.exe
2216	Unicorn-62563.exe
228	Unicorn-18271.exe
2880	Unicorn-23690.exe
4680	Unicorn-37011.exe
4924	Unicorn-2200.exe
1196	Unicorn-51209.exe
4880	Unicorn-14452.exe
3284	Unicorn-31343.exe
4676	Unicorn-27774.exe
4852	Unicorn-56362.exe
4356	Unicorn-5115.exe
4184	Unicorn-56917.exe
3080	Unicorn-12049.exe
2792	Unicorn-11245.exe
1536	Unicorn-5115.exe
412	Unicorn-63139.exe
1060	Unicorn-11245.exe
2572	Unicorn-49818.exe
1124	Unicorn-64837.exe
3520	Unicorn-51317.exe
3420	Unicorn-40794.exe
1644	Unicorn-19305.exe
3148	Unicorn-45947.exe
384	Unicorn-50835.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3812 wrote to memory of 1936	3812	49e45d83f5e0ba26d8e947a594cf4ac0N.exe	91
PID 3812 wrote to memory of 1936	3812	49e45d83f5e0ba26d8e947a594cf4ac0N.exe	91
PID 3812 wrote to memory of 1936	3812	49e45d83f5e0ba26d8e947a594cf4ac0N.exe	91
PID 1936 wrote to memory of 4312	1936	Unicorn-50459.exe	94
PID 1936 wrote to memory of 4312	1936	Unicorn-50459.exe	94
PID 1936 wrote to memory of 4312	1936	Unicorn-50459.exe	94
PID 3812 wrote to memory of 3772	3812	49e45d83f5e0ba26d8e947a594cf4ac0N.exe	95
PID 3812 wrote to memory of 3772	3812	49e45d83f5e0ba26d8e947a594cf4ac0N.exe	95
PID 3812 wrote to memory of 3772	3812	49e45d83f5e0ba26d8e947a594cf4ac0N.exe	95
PID 4312 wrote to memory of 4076	4312	Unicorn-35083.exe	97
PID 4312 wrote to memory of 4076	4312	Unicorn-35083.exe	97
PID 4312 wrote to memory of 4076	4312	Unicorn-35083.exe	97
PID 1936 wrote to memory of 372	1936	Unicorn-50459.exe	98
PID 1936 wrote to memory of 372	1936	Unicorn-50459.exe	98
PID 1936 wrote to memory of 372	1936	Unicorn-50459.exe	98
PID 3772 wrote to memory of 4484	3772	Unicorn-11133.exe	99
PID 3772 wrote to memory of 4484	3772	Unicorn-11133.exe	99
PID 3772 wrote to memory of 4484	3772	Unicorn-11133.exe	99
PID 3812 wrote to memory of 1532	3812	49e45d83f5e0ba26d8e947a594cf4ac0N.exe	100
PID 3812 wrote to memory of 1532	3812	49e45d83f5e0ba26d8e947a594cf4ac0N.exe	100
PID 3812 wrote to memory of 1532	3812	49e45d83f5e0ba26d8e947a594cf4ac0N.exe	100
PID 4076 wrote to memory of 4844	4076	Unicorn-46409.exe	103
PID 4076 wrote to memory of 4844	4076	Unicorn-46409.exe	103
PID 4076 wrote to memory of 4844	4076	Unicorn-46409.exe	103
PID 4312 wrote to memory of 3984	4312	Unicorn-35083.exe	104
PID 4312 wrote to memory of 3984	4312	Unicorn-35083.exe	104
PID 4312 wrote to memory of 3984	4312	Unicorn-35083.exe	104
PID 1532 wrote to memory of 4748	1532	Unicorn-13636.exe	105
PID 1532 wrote to memory of 4748	1532	Unicorn-13636.exe	105
PID 1532 wrote to memory of 4748	1532	Unicorn-13636.exe	105
PID 372 wrote to memory of 2896	372	Unicorn-38795.exe	106
PID 372 wrote to memory of 2896	372	Unicorn-38795.exe	106
PID 372 wrote to memory of 2896	372	Unicorn-38795.exe	106
PID 1936 wrote to memory of 2356	1936	Unicorn-50459.exe	107
PID 1936 wrote to memory of 2356	1936	Unicorn-50459.exe	107
PID 1936 wrote to memory of 2356	1936	Unicorn-50459.exe	107
PID 3772 wrote to memory of 3136	3772	Unicorn-11133.exe	108
PID 3772 wrote to memory of 3136	3772	Unicorn-11133.exe	108
PID 3772 wrote to memory of 3136	3772	Unicorn-11133.exe	108
PID 3812 wrote to memory of 4544	3812	49e45d83f5e0ba26d8e947a594cf4ac0N.exe	109
PID 3812 wrote to memory of 4544	3812	49e45d83f5e0ba26d8e947a594cf4ac0N.exe	109
PID 3812 wrote to memory of 4544	3812	49e45d83f5e0ba26d8e947a594cf4ac0N.exe	109
PID 4484 wrote to memory of 4612	4484	Unicorn-23851.exe	110
PID 4484 wrote to memory of 4612	4484	Unicorn-23851.exe	110
PID 4484 wrote to memory of 4612	4484	Unicorn-23851.exe	110
PID 4844 wrote to memory of 1840	4844	Unicorn-38023.exe	111
PID 4844 wrote to memory of 1840	4844	Unicorn-38023.exe	111
PID 4844 wrote to memory of 1840	4844	Unicorn-38023.exe	111
PID 3984 wrote to memory of 4436	3984	Unicorn-28271.exe	112
PID 3984 wrote to memory of 4436	3984	Unicorn-28271.exe	112
PID 3984 wrote to memory of 4436	3984	Unicorn-28271.exe	112
PID 4076 wrote to memory of 1172	4076	Unicorn-46409.exe	113
PID 4076 wrote to memory of 1172	4076	Unicorn-46409.exe	113
PID 4076 wrote to memory of 1172	4076	Unicorn-46409.exe	113
PID 4312 wrote to memory of 1176	4312	Unicorn-35083.exe	114
PID 4312 wrote to memory of 1176	4312	Unicorn-35083.exe	114
PID 4312 wrote to memory of 1176	4312	Unicorn-35083.exe	114
PID 3136 wrote to memory of 5068	3136	Unicorn-46746.exe	115
PID 3136 wrote to memory of 5068	3136	Unicorn-46746.exe	115
PID 3136 wrote to memory of 5068	3136	Unicorn-46746.exe	115
PID 4748 wrote to memory of 5016	4748	Unicorn-56305.exe	116
PID 4748 wrote to memory of 5016	4748	Unicorn-56305.exe	116
PID 4748 wrote to memory of 5016	4748	Unicorn-56305.exe	116
PID 1532 wrote to memory of 5040	1532	Unicorn-13636.exe	117

C:\Users\Admin\AppData\Local\Temp\49e45d83f5e0ba26d8e947a594cf4ac0N.exe
"C:\Users\Admin\AppData\Local\Temp\49e45d83f5e0ba26d8e947a594cf4ac0N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3812
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50459.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50459.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35083.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35083.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46409.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46409.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38023.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15547.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49948.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18236.exe
        8⤵
        
        PID:2272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50462.exe
        9⤵
        
        PID:6364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48490.exe
        10⤵
        
        PID:7320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63050.exe
        11⤵
        
        PID:1668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59913.exe
        11⤵
        
        PID:15456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25028.exe
        10⤵
        
        PID:9884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54267.exe
        10⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29776.exe
        9⤵
        
        PID:8448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28807.exe
        10⤵
        
        PID:12156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49082.exe
        10⤵
        
        PID:10104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48277.exe
        9⤵
        
        PID:12872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31125.exe
        9⤵
        
        PID:14832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11053.exe
        8⤵
        
        PID:6492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55589.exe
        9⤵
        
        PID:7284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44126.exe
        10⤵
        
        PID:9796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16855.exe
        10⤵
        
        PID:13372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60410.exe
        10⤵
        
        PID:1260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25412.exe
        9⤵
        
        PID:10368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50611.exe
        8⤵
        
        PID:8348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33804.exe
        8⤵
        
        PID:12280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45899.exe
        8⤵
        
        PID:16172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58754.exe
        7⤵
        
        PID:1168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4468.exe
        8⤵
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25932.exe
        9⤵
        
        PID:7264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17349.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:11496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33954.exe
        10⤵
        
        PID:13888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9620.exe
        10⤵
        
        PID:4444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64887.exe
        9⤵
        
        PID:12116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15713.exe
        9⤵
        
        PID:12124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51763.exe
        8⤵
        
        PID:7792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31941.exe
        8⤵
        
        PID:12732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55580.exe
        8⤵
        
        PID:14616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14789.exe
        8⤵
        
        PID:16316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40248.exe
        7⤵
        
        PID:6292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25932.exe
        8⤵
        
        PID:7240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17349.exe
        9⤵
        
        PID:11460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23818.exe
        9⤵
        
        PID:13616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39117.exe
        8⤵
        
        PID:10840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48978.exe
        9⤵
        
        PID:14816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50296.exe
        8⤵
        
        PID:9184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3876.exe
        7⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44951.exe
        8⤵
        
        PID:12484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9620.exe
        8⤵
        
        PID:14400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26716.exe
        8⤵
        
        PID:10204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63457.exe
        7⤵
        
        PID:11948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44491.exe
        7⤵
        
        PID:16404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4125.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40073.exe
        7⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4276.exe
        8⤵
        
        PID:6428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26316.exe
        9⤵
        
        PID:7756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14717.exe
        10⤵
        
        PID:10100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30307.exe
        10⤵
        
        PID:10564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59045.exe
        9⤵
        
        PID:7100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51089.exe
        9⤵
        
        PID:14876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60410.exe
        9⤵
        
        PID:1220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1572.exe
        8⤵
        
        PID:8836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18427.exe
        8⤵
        
        PID:13000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4291.exe
        8⤵
        
        PID:15864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11053.exe
        7⤵
        
        PID:6484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16394.exe
        8⤵
        
        PID:7436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9014.exe
        9⤵
        
        PID:1976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61811.exe
        9⤵
        
        PID:14952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19315.exe
        9⤵
        
        PID:17144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55454.exe
        8⤵
        
        PID:10760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50296.exe
        8⤵
        
        PID:13888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63548.exe
        7⤵
        
        PID:4932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2740.exe
        8⤵
        
        PID:12800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9620.exe
        8⤵
        
        PID:2092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6585.exe
        7⤵
        
        PID:11936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45323.exe
        7⤵
        
        PID:15712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56501.exe
        6⤵
        
        PID:5308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63098.exe
        7⤵
        
        PID:6684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7862.exe
        8⤵
        
        PID:9592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17671.exe
        9⤵
        
        PID:13408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34124.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:15872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64110.exe
        8⤵
        
        PID:14304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48585.exe
        8⤵
        
        PID:10520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40897.exe
        7⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15624.exe
        7⤵
        
        PID:13344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5423.exe
        7⤵
        
        PID:15220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14701.exe
        6⤵
        
        PID:6788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38267.exe
        7⤵
        
        PID:7944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11318.exe
        8⤵
        
        PID:11576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9620.exe
        8⤵
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62444.exe
        7⤵
        
        PID:10972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52362.exe
        6⤵
        
        PID:7336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61287.exe
        7⤵
        
        PID:12828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21680.exe
        7⤵
        
        PID:15524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12386.exe
        6⤵
        
        PID:12432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21255.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7270.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45947.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31364.exe
        8⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36835.exe
        9⤵
        
        PID:8168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1889.exe
        9⤵
        
        PID:13396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15485.exe
        9⤵
        
        PID:15920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30896.exe
        8⤵
        
        PID:9584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18173.exe
        8⤵
        
        PID:14312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31125.exe
        8⤵
        
        PID:16748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6585.exe
        7⤵
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29653.exe
        8⤵
        
        PID:8860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64748.exe
        8⤵
        
        PID:12964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15485.exe
        8⤵
        
        PID:15804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33828.exe
        7⤵
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18811.exe
        7⤵
        
        PID:12852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63907.exe
        6⤵
        
        PID:4052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4468.exe
        7⤵
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-358.exe
        8⤵
        
        PID:7504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37795.exe
        9⤵
        
        PID:9496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62688.exe
        9⤵
        
        PID:14904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29786.exe
        9⤵
        
        PID:17212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43778.exe
        8⤵
        
        PID:8316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19569.exe
        8⤵
        
        PID:15728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17684.exe
        7⤵
        
        PID:8368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17131.exe
        8⤵
        
        PID:12364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62713.exe
        8⤵
        
        PID:15560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44001.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37731.exe
        7⤵
        
        PID:16504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63683.exe
        6⤵
        
        PID:6408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20286.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51692.exe
        8⤵
        
        PID:10128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51697.exe
        8⤵
        
        PID:14820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19315.exe
        8⤵
        
        PID:17132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43778.exe
        7⤵
        
        PID:11236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44608.exe
        6⤵
        
        PID:8948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60826.exe
        6⤵
        
        PID:11516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19410.exe
        6⤵
        
        PID:15408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17860.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6331.exe
        6⤵
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22895.exe
        7⤵
        
        PID:6832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63050.exe
        8⤵
        
        PID:9544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41971.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53743.exe
        7⤵
        
        PID:14708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45323.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60638.exe
        6⤵
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10393.exe
        7⤵
        
        PID:8336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55257.exe
        8⤵
        
        PID:12600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62713.exe
        8⤵
        
        PID:15552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12205.exe
        7⤵
        
        PID:13116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55822.exe
        7⤵
        
        PID:15756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40689.exe
        6⤵
        
        PID:7624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41879.exe
        7⤵
        
        PID:9408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35168.exe
        7⤵
        
        PID:4848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11976.exe
        7⤵
        
        PID:14944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17021.exe
        7⤵
        
        PID:16908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32076.exe
        6⤵
        
        PID:10796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31125.exe
        6⤵
        
        PID:16788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6450.exe
        5⤵
        
        PID:5584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25932.exe
        6⤵
        
        PID:7272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41962.exe
        7⤵
        
        PID:2208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9620.exe
        7⤵
        
        PID:14540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64887.exe
        6⤵
        
        PID:12100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47811.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16747.exe
        6⤵
        
        PID:12896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53463.exe
        5⤵
        
        PID:12908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31877.exe
        5⤵
        
        PID:17884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28271.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28271.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41121.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57047.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12013.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27027.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37451.exe
        9⤵
        
        PID:8760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44951.exe
        10⤵
        
        PID:12540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9620.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:14604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25154.exe
        10⤵
        
        PID:12128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18427.exe
        9⤵
        
        PID:12948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35209.exe
        9⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15085.exe
        8⤵
        
        PID:8656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13394.exe
        9⤵
        
        PID:11436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18427.exe
        8⤵
        
        PID:12984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31125.exe
        8⤵
        
        PID:16796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27389.exe
        7⤵
        
        PID:6396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34759.exe
        8⤵
        
        PID:8848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12278.exe
        9⤵
        
        PID:12512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42101.exe
        9⤵
        
        PID:5336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63212.exe
        8⤵
        
        PID:11932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38837.exe
        8⤵
        
        PID:11872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52626.exe
        8⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4171.exe
        7⤵
        
        PID:8524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28807.exe
        8⤵
        
        PID:11636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20493.exe
        8⤵
        
        PID:8108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18811.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15372.exe
        7⤵
        
        PID:5184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63907.exe
        6⤵
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24313.exe
        7⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47971.exe
        8⤵
        
        PID:8088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20686.exe
        9⤵
        
        PID:13884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27902.exe
        9⤵
        
        PID:15848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25661.exe
        8⤵
        
        PID:12752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45059.exe
        8⤵
        
        PID:13848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27546.exe
        8⤵
        
        PID:15372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55480.exe
        7⤵
        
        PID:8988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31960.exe
        7⤵
        
        PID:13540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56584.exe
        6⤵
        
        PID:6148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25932.exe
        7⤵
        
        PID:7232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38921.exe
        8⤵
        
        PID:12416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9620.exe
        8⤵
        
        PID:1548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64887.exe
        7⤵
        
        PID:12108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35339.exe
        7⤵
        
        PID:16304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22171.exe
        7⤵
        
        PID:12192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37810.exe
        6⤵
        
        PID:6312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38953.exe
        6⤵
        
        PID:11844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54797.exe
        6⤵
        
        PID:3952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62563.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35989.exe
        6⤵
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51915.exe
        7⤵
        
        PID:6600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1640.exe
        8⤵
        
        PID:9100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29408.exe
        8⤵
        
        PID:13468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18880.exe
        8⤵
        
        PID:15480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46051.exe
        7⤵
        
        PID:8644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50461.exe
        8⤵
        
        PID:16296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15624.exe
        7⤵
        
        PID:12740
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12740 -s 472
        8⤵
        Program crash
        
        PID:14860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18880.exe
        7⤵
        
        PID:15568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20866.exe
        6⤵
        
        PID:6640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17401.exe
        7⤵
        
        PID:8756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47395.exe
        7⤵
        
        PID:10004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64332.exe
        7⤵
        
        PID:13492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41631.exe
        7⤵
        
        PID:16428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59786.exe
        6⤵
        
        PID:8216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21489.exe
        6⤵
        
        PID:13364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31125.exe
        6⤵
        
        PID:16804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-585.exe
        5⤵
        
        PID:5596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19326.exe
        6⤵
        
        PID:6844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20307.exe
        7⤵
        
        PID:9236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9865.exe
        7⤵
        
        PID:13768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29684.exe
        7⤵
        
        PID:14880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30494.exe
        7⤵
        
        PID:10440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58962.exe
        6⤵
        
        PID:8576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54769.exe
        6⤵
        
        PID:14896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59652.exe
        6⤵
        
        PID:17124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20212.exe
        5⤵
        
        PID:7408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44012.exe
        6⤵
        
        PID:14220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27902.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23986.exe
        5⤵
        
        PID:11188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62965.exe
        5⤵
        
        PID:16196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20408.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20408.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50825.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44686.exe
        6⤵
        
        PID:4796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35195.exe
        7⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28153.exe
        8⤵
        
        PID:8556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28807.exe
        9⤵
        
        PID:3896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63472.exe
        9⤵
        
        PID:11644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12562.exe
        8⤵
        
        PID:12968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6820.exe
        8⤵
        
        PID:14952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27280.exe
        8⤵
        
        PID:9072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44250.exe
        7⤵
        
        PID:7980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26075.exe
        7⤵
        
        PID:12784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48786.exe
        7⤵
        
        PID:13844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43577.exe
        7⤵
        
        PID:4116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27389.exe
        6⤵
        
        PID:6388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1640.exe
        7⤵
        
        PID:9008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64748.exe
        7⤵
        
        PID:12836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56326.exe
        7⤵
        
        PID:13548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11654.exe
        6⤵
        
        PID:7772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37852.exe
        7⤵
        
        PID:12504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9620.exe
        7⤵
        
        PID:1180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62389.exe
        6⤵
        
        PID:15660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4400.exe
        5⤵
        
        PID:4520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46378.exe
        6⤵
        
        PID:6300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21355.exe
        7⤵
        
        PID:7488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9014.exe
        8⤵
        
        PID:3260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25931.exe
        8⤵
        
        PID:13648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19315.exe
        8⤵
        
        PID:17092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43778.exe
        7⤵
        
        PID:11204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15485.exe
        7⤵
        
        PID:15964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2065.exe
        6⤵
        
        PID:8384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11209.exe
        7⤵
        
        PID:12400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23818.exe
        7⤵
        
        PID:2984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35953.exe
        7⤵
        
        PID:10868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48277.exe
        6⤵
        
        PID:12880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18681.exe
        6⤵
        
        PID:16140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24788.exe
        5⤵
        
        PID:6472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47971.exe
        6⤵
        
        PID:8396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34898.exe
        6⤵
        
        PID:12704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62932.exe
        6⤵
        
        PID:5616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-114.exe
        5⤵
        
        PID:8568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12824.exe
        5⤵
        
        PID:13336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60835.exe
        5⤵
        
        PID:14940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60443.exe
        5⤵
        
        PID:15364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18271.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18271.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17275.exe
        5⤵
        
        PID:6324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48106.exe
        6⤵
        
        PID:6708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23763.exe
        7⤵
        
        PID:4688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36725.exe
        7⤵
        
        PID:3268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55070.exe
        6⤵
        
        PID:10500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61022.exe
        6⤵
        
        PID:3832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37098.exe
        5⤵
        
        PID:8180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11209.exe
        6⤵
        
        PID:12392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23818.exe
        6⤵
        
        PID:1928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19616.exe
        6⤵
        
        PID:184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16891.exe
        5⤵
        
        PID:11812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2345.exe
        5⤵
        
        PID:15504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64199.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64199.exe
      4⤵
      PID:5676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12034.exe
        5⤵
        
        PID:6876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63050.exe
        6⤵
        
        PID:116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25102.exe
        6⤵
        
        PID:14936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34457.exe
        5⤵
        
        PID:9296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29028.exe
        5⤵
        
        PID:14576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12029.exe
        5⤵
        
        PID:14952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25102.exe
        5⤵
        
        PID:3000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60549.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60549.exe
      4⤵
      PID:7384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26311.exe
        5⤵
        
        PID:10644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19734.exe
        5⤵
        
        PID:5420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63411.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63411.exe
      4⤵
      PID:11244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19187.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19187.exe
      4⤵
      PID:15740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38795.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38795.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21495.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21495.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59979.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23690.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46103.exe
        7⤵
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41609.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25199.exe
        9⤵
        
        PID:8708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11410.exe
        9⤵
        
        PID:11336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6820.exe
        9⤵
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42713.exe
        8⤵
        
        PID:7380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23509.exe
        9⤵
        
        PID:14148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7120.exe
        9⤵
        
        PID:14912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43699.exe
        8⤵
        
        PID:11984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18880.exe
        8⤵
        
        PID:15432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60638.exe
        7⤵
        
        PID:6804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4442.exe
        8⤵
        
        PID:7460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48293.exe
        9⤵
        
        PID:10276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15485.exe
        9⤵
        
        PID:15928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43778.exe
        8⤵
        
        PID:11220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15485.exe
        8⤵
        
        PID:15956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56449.exe
        7⤵
        
        PID:7448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63150.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57612.exe
        8⤵
        
        PID:14956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3041.exe
        8⤵
        
        PID:16708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49564.exe
        7⤵
        
        PID:11976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2345.exe
        7⤵
        
        PID:15676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30705.exe
        6⤵
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37115.exe
        7⤵
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59346.exe
        8⤵
        
        PID:7784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6820.exe
        8⤵
        
        PID:3408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42433.exe
        7⤵
        
        PID:10148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40217.exe
        7⤵
        
        PID:10060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32136.exe
        6⤵
        
        PID:8116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11209.exe
        7⤵
        
        PID:12692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26140.exe
        7⤵
        
        PID:8536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16891.exe
        6⤵
        
        PID:11800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31125.exe
        6⤵
        
        PID:16756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56917.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48625.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1453.exe
        7⤵
        
        PID:7104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56295.exe
        8⤵
        
        PID:9012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64748.exe
        8⤵
        
        PID:12520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15485.exe
        8⤵
        
        PID:15936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52657.exe
        7⤵
        
        PID:8512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44213.exe
        7⤵
        
        PID:13724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43385.exe
        7⤵
        
        PID:16132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18427.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36451.exe
        7⤵
        
        PID:8932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18225.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15485.exe
        7⤵
        
        PID:15944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64145.exe
        6⤵
        
        PID:9944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44624.exe
        6⤵
        
        PID:6984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8567.exe
        6⤵
        
        PID:9180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34134.exe
        5⤵
        
        PID:5860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37115.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18553.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16855.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8896.exe
        7⤵
        
        PID:7040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50113.exe
        6⤵
        
        PID:11656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7945.exe
        6⤵
        
        PID:15064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59913.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38002.exe
        5⤵
        
        PID:7936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5890.exe
        6⤵
        
        PID:10464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54712.exe
        6⤵
        
        PID:14588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5117.exe
        6⤵
        
        PID:17184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7842.exe
        5⤵
        
        PID:10980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31855.exe
        5⤵
        
        PID:3912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46336.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46336.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14452.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63015.exe
        6⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37115.exe
        7⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39715.exe
        8⤵
        
        PID:11752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9620.exe
        8⤵
        
        PID:10668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47712.exe
        8⤵
        
        PID:11716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64307.exe
        7⤵
        
        PID:10256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40511.exe
        7⤵
        
        PID:5656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64015.exe
        6⤵
        
        PID:9040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22331.exe
        7⤵
        
        PID:14100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36393.exe
        7⤵
        
        PID:4776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65235.exe
        7⤵
        
        PID:5580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48578.exe
        6⤵
        
        PID:396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48289.exe
        6⤵
        
        PID:13364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31125.exe
        6⤵
        
        PID:16732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1545.exe
        5⤵
        
        PID:7152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28475.exe
        6⤵
        
        PID:9380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46507.exe
        7⤵
        
        PID:6892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59964.exe
        7⤵
        
        PID:12140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53420.exe
        6⤵
        
        PID:14200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37660.exe
        6⤵
        
        PID:16108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40462.exe
        5⤵
        
        PID:7764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41413.exe
        5⤵
        
        PID:13704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5115.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5115.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26067.exe
        5⤵
        
        PID:5804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37115.exe
        6⤵
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51692.exe
        7⤵
        
        PID:10120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21065.exe
        7⤵
        
        PID:11008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43009.exe
        6⤵
        
        PID:9440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16934.exe
        6⤵
        
        PID:5032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64015.exe
        5⤵
        
        PID:9128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8962.exe
        6⤵
        
        PID:13180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23818.exe
        6⤵
        
        PID:13648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40218.exe
        5⤵
        
        PID:11828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37731.exe
        5⤵
        
        PID:16492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23664.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23664.exe
      4⤵
      PID:6000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20779.exe
        5⤵
        
        PID:7532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64307.exe
        6⤵
        
        PID:10264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6820.exe
        6⤵
        
        PID:15268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42433.exe
        5⤵
        
        PID:9788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59913.exe
        5⤵
        
        PID:15512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13000.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13000.exe
      4⤵
      PID:8376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28807.exe
        5⤵
        
        PID:12172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54545.exe
        5⤵
        
        PID:16180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8603.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8603.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41434.exe
      4⤵
      PID:16044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60481.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60481.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59979.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59979.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37011.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39881.exe
        6⤵
        
        PID:5396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40732.exe
        7⤵
        
        PID:6648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44619.exe
        8⤵
        
        PID:9036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14141.exe
        8⤵
        
        PID:13448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15702.exe
        8⤵
        
        PID:14736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60938.exe
        7⤵
        
        PID:10224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4660.exe
        7⤵
        
        PID:13444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43185.exe
        7⤵
        
        PID:5444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60638.exe
        6⤵
        
        PID:6780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28475.exe
        7⤵
        
        PID:9388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53420.exe
        7⤵
        
        PID:14108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61989.exe
        7⤵
        
        PID:17052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28566.exe
        6⤵
        
        PID:8964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9892.exe
        6⤵
        
        PID:14836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15902.exe
        6⤵
        
        PID:16188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53264.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40924.exe
        6⤵
        
        PID:2968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1640.exe
        7⤵
        
        PID:7484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47089.exe
        8⤵
        
        PID:12552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-73.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-73.exe
        8⤵
        
        PID:11376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7919.exe
        7⤵
        
        PID:13528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15485.exe
        7⤵
        
        PID:15748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63155.exe
        6⤵
        
        PID:9696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21532.exe
        7⤵
        
        PID:15324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36725.exe
        7⤵
        
        PID:3324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12308.exe
        6⤵
        
        PID:13476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61859.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55105.exe
        5⤵
        
        PID:6924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43550.exe
        6⤵
        
        PID:4820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1889.exe
        6⤵
        
        PID:13380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27546.exe
        6⤵
        
        PID:15392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57758.exe
        5⤵
        
        PID:10064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61532.exe
        5⤵
        
        PID:14360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62389.exe
        5⤵
        
        PID:15696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31343.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31343.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26067.exe
        5⤵
        
        PID:5772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27001.exe
        6⤵
        
        PID:7544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41962.exe
        7⤵
        
        PID:10652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60540.exe
        7⤵
        
        PID:16092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54807.exe
        7⤵
        
        PID:11736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43778.exe
        6⤵
        
        PID:11228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43097.exe
        5⤵
        
        PID:8484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60410.exe
        6⤵
        
        PID:11596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9620.exe
        6⤵
        
        PID:15068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27938.exe
        5⤵
        
        PID:12268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6969.exe
        5⤵
        
        PID:10664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-393.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-393.exe
      4⤵
      PID:6044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28947.exe
        5⤵
        
        PID:5632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52844.exe
        6⤵
        
        PID:10036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43009.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59913.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60560.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60560.exe
      4⤵
      PID:7868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41879.exe
        5⤵
        
        PID:9344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18303.exe
        5⤵
        
        PID:14860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49669.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49669.exe
      4⤵
      PID:10388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17371.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17371.exe
      4⤵
      PID:6592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18473.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18473.exe
      4⤵
      PID:10824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-399.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-399.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11245.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11245.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40025.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44681.exe
        6⤵
        
        PID:7908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47089.exe
        7⤵
        
        PID:12560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9620.exe
        7⤵
        
        PID:9156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53166.exe
        7⤵
        
        PID:11724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29963.exe
        6⤵
        
        PID:11996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15485.exe
        6⤵
        
        PID:15988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39703.exe
        5⤵
        
        PID:6908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48770.exe
        5⤵
        
        PID:12332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52405.exe
        5⤵
        
        PID:16084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29636.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29636.exe
      4⤵
      PID:6132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48874.exe
        5⤵
        
        PID:7776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9014.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15485.exe
        6⤵
        
        PID:16856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13051.exe
        5⤵
        
        PID:11148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64494.exe
        5⤵
        
        PID:5024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49625.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49625.exe
      4⤵
      PID:8996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3954.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3954.exe
      4⤵
      PID:11608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27425.exe
      4⤵
      PID:16388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64837.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64837.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26067.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26067.exe
      4⤵
      PID:5796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37115.exe
        5⤵
        
        PID:1852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39658.exe
        6⤵
        
        PID:9452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64110.exe
        6⤵
        
        PID:13536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15485.exe
        6⤵
        
        PID:16864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42433.exe
        5⤵
        
        PID:9840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10650.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18401.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18401.exe
      4⤵
      PID:8000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58106.exe
        5⤵
        
        PID:10444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13347.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-144.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-144.exe
      4⤵
      PID:10908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43961.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43961.exe
      4⤵
      PID:16396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46594.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46594.exe
    3⤵
    PID:6068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37115.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37115.exe
      4⤵
      PID:5316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57722.exe
        5⤵
        
        PID:9252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21328.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21328.exe
      4⤵
      PID:10324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26986.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26986.exe
      4⤵
      PID:17228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29867.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29867.exe
    3⤵
    PID:7916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30286.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30286.exe
      4⤵
      PID:10988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9620.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9620.exe
      4⤵
      PID:14732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52378.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52378.exe
    3⤵
    PID:11420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56636.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56636.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:16100
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11133.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11133.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23851.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23851.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2781.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2781.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36928.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40794.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62330.exe
        7⤵
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48874.exe
        8⤵
        
        PID:8044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48075.exe
        9⤵
        
        PID:11488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9620.exe
        9⤵
        
        PID:15012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10228.exe
        8⤵
        
        PID:3664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4987.exe
        8⤵
        
        PID:15632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41426.exe
        7⤵
        
        PID:7704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48058.exe
        7⤵
        
        PID:12316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47469.exe
        7⤵
        
        PID:16124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3570.exe
        6⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7794.exe
        7⤵
        
        PID:8744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18427.exe
        7⤵
        
        PID:12956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-399.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63548.exe
        6⤵
        
        PID:7224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9014.exe
        7⤵
        
        PID:3116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54235.exe
        8⤵
        
        PID:14084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29684.exe
        7⤵
        
        PID:14876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9517.exe
        6⤵
        
        PID:10772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39293.exe
        6⤵
        
        PID:16204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9553.exe
        5⤵
        Executes dropped EXE
        
        PID:4124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50462.exe
        6⤵
        
        PID:6356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62771.exe
        7⤵
        
        PID:8072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10228.exe
        7⤵
        
        PID:2712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15485.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58832.exe
        6⤵
        
        PID:7452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31721.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58609.exe
        6⤵
        
        PID:1772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11467.exe
        5⤵
        
        PID:6452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4141.exe
        6⤵
        
        PID:7172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29627.exe
        7⤵
        
        PID:920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62828.exe
        7⤵
        
        PID:11820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15485.exe
        7⤵
        
        PID:15896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5760.exe
        6⤵
        
        PID:8628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12895.exe
        5⤵
        
        PID:6856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44012.exe
        6⤵
        
        PID:14232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27902.exe
        6⤵
        
        PID:15472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39228.exe
        5⤵
        
        PID:12296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35939.exe
        5⤵
        
        PID:4832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26713.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26713.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19305.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50078.exe
        6⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54603.exe
        7⤵
        
        PID:7832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9014.exe
        8⤵
        
        PID:4572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33768.exe
        8⤵
        
        PID:17280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5760.exe
        7⤵
        
        PID:3448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15293.exe
        7⤵
        
        PID:16212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5163.exe
        6⤵
        
        PID:8968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63626.exe
        6⤵
        
        PID:11640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4682.exe
        6⤵
        
        PID:1140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53648.exe
        5⤵
        
        PID:5472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37115.exe
        6⤵
        
        PID:6468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6985.exe
        7⤵
        
        PID:9224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1526.exe
        8⤵
        
        PID:13356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9865.exe
        7⤵
        
        PID:13760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15485.exe
        7⤵
        
        PID:16840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42433.exe
        6⤵
        
        PID:9976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48904.exe
        6⤵
        
        PID:14912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17841.exe
        6⤵
        
        PID:14948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32136.exe
        5⤵
        
        PID:7960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61614.exe
        6⤵
        
        PID:10292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46377.exe
        6⤵
        
        PID:4272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63378.exe
        5⤵
        
        PID:11196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50835.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50835.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50078.exe
        5⤵
        
        PID:5360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48106.exe
        6⤵
        
        PID:6692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64499.exe
        7⤵
        
        PID:8940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6820.exe
        7⤵
        
        PID:4772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42433.exe
        6⤵
        
        PID:9904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35583.exe
        6⤵
        
        PID:15068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47966.exe
        6⤵
        
        PID:6968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23362.exe
        5⤵
        
        PID:8172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24531.exe
        6⤵
        
        PID:12572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23818.exe
        6⤵
        
        PID:3532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39160.exe
        6⤵
        
        PID:11016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11026.exe
        5⤵
        
        PID:11832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23087.exe
        5⤵
        
        PID:17908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17520.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17520.exe
      4⤵
      PID:5660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60010.exe
        5⤵
        
        PID:8688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5179.exe
        6⤵
        
        PID:12352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52372.exe
        6⤵
        
        PID:6900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10759.exe
        6⤵
        
        PID:8844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18427.exe
        5⤵
        
        PID:12976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31125.exe
        5⤵
        
        PID:16812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57534.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57534.exe
      4⤵
      PID:7208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24282.exe
        5⤵
        
        PID:9808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16855.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60410.exe
        5⤵
        
        PID:3364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36878.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36878.exe
      4⤵
      PID:10356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30064.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30064.exe
      4⤵
      PID:3292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27677.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27677.exe
      4⤵
      PID:17896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46746.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46746.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6118.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6118.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28075.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12890.exe
        6⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50462.exe
        7⤵
        
        PID:6348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42844.exe
        8⤵
        
        PID:8032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40099.exe
        9⤵
        
        PID:11472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52289.exe
        9⤵
        
        PID:11380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27633.exe
        8⤵
        
        PID:11168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27546.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46497.exe
        7⤵
        
        PID:8976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18880.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34764.exe
        7⤵
        
        PID:13172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43377.exe
        7⤵
        
        PID:15064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49948.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9211.exe
        7⤵
        
        PID:3476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8054.exe
        8⤵
        
        PID:9016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1889.exe
        8⤵
        
        PID:13388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15485.exe
        8⤵
        
        PID:15912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11515.exe
        7⤵
        
        PID:10024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64332.exe
        7⤵
        
        PID:14344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62309.exe
        7⤵
        
        PID:4344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47706.exe
        6⤵
        
        PID:7512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32128.exe
        6⤵
        
        PID:10508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58396.exe
        6⤵
        
        PID:1560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62389.exe
        6⤵
        
        PID:15668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9024.exe
        5⤵
        
        PID:5168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50462.exe
        6⤵
        
        PID:6340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10393.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54235.exe
        8⤵
        
        PID:14140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27902.exe
        8⤵
        
        PID:15856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44001.exe
        7⤵
        
        PID:13140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43377.exe
        7⤵
        
        PID:1380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17684.exe
        6⤵
        
        PID:8296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44001.exe
        6⤵
        
        PID:13132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63683.exe
        5⤵
        
        PID:6416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29653.exe
        6⤵
        
        PID:9068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28365.exe
        7⤵
        
        PID:16156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14141.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25600.exe
        6⤵
        
        PID:2164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58138.exe
        5⤵
        
        PID:10216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44996.exe
        5⤵
        
        PID:14352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62563.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62563.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32162.exe
        5⤵
        
        PID:6284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63050.exe
        6⤵
        
        PID:8888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6820.exe
        6⤵
        
        PID:2836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4473.exe
        5⤵
        
        PID:9960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48211.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48191.exe
        5⤵
        
        PID:16420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17990.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17990.exe
      4⤵
      PID:5548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55781.exe
        5⤵
        
        PID:6872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63050.exe
        6⤵
        
        PID:9316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6820.exe
        6⤵
        
        PID:4068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25028.exe
        5⤵
        
        PID:10076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43943.exe
        5⤵
        
        PID:14704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25102.exe
        5⤵
        
        PID:6524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62314.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62314.exe
      4⤵
      PID:7420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45143.exe
        5⤵
        
        PID:10904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9620.exe
        5⤵
        
        PID:1996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30307.exe
        5⤵
        
        PID:12076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18416.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18416.exe
      4⤵
      PID:12628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26660.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26660.exe
      4⤵
      PID:3280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23122.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23122.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11245.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11245.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13622.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25932.exe
        6⤵
        
        PID:7248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58106.exe
        7⤵
        
        PID:10452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19315.exe
        7⤵
        
        PID:17160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39117.exe
        6⤵
        
        PID:10832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58097.exe
        6⤵
        
        PID:6756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5106.exe
        6⤵
        
        PID:12180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36875.exe
        5⤵
        
        PID:8340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15558.exe
        6⤵
        
        PID:16004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48277.exe
        5⤵
        
        PID:12888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31125.exe
        5⤵
        
        PID:16724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42957.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42957.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23554.exe
        5⤵
        
        PID:7884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34461.exe
        5⤵
        
        PID:10304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5106.exe
        5⤵
        
        PID:2648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23968.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23968.exe
      4⤵
      PID:7852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60078.exe
        5⤵
        
        PID:9348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53420.exe
        5⤵
        
        PID:14124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58437.exe
        5⤵
        
        PID:16116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44629.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44629.exe
      4⤵
      PID:7220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60443.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60443.exe
      4⤵
      PID:13728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12049.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12049.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40265.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40265.exe
      4⤵
      PID:5868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60249.exe
        5⤵
        
        PID:7740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30286.exe
        6⤵
        
        PID:11028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59045.exe
        5⤵
        
        PID:10728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51089.exe
        5⤵
        
        PID:15004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27606.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27606.exe
      4⤵
      PID:8864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18811.exe
      4⤵
      PID:12916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31125.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31125.exe
      4⤵
      PID:16740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27250.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27250.exe
    3⤵
    PID:6084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47971.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47971.exe
      4⤵
      PID:7348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4733.exe
        5⤵
        
        PID:13404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27902.exe
        5⤵
        
        PID:1528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17986.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17986.exe
      4⤵
      PID:12468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4729.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4729.exe
      4⤵
      PID:9552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59070.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59070.exe
    3⤵
    PID:7880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23805.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23805.exe
    3⤵
    PID:12720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35523.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35523.exe
    3⤵
    PID:16376
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13636.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13636.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56305.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56305.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6118.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6118.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51209.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23052.exe
        6⤵
        
        PID:5464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51038.exe
        7⤵
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11946.exe
        8⤵
        
        PID:9732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51666.exe
        8⤵
        
        PID:13376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6164.exe
        8⤵
        
        PID:14008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29684.exe
        8⤵
        
        PID:14828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57701.exe
        7⤵
        
        PID:9928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38759.exe
        7⤵
        
        PID:8792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25102.exe
        7⤵
        
        PID:15000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28240.exe
        6⤵
        
        PID:6608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63050.exe
        7⤵
        
        PID:10012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61859.exe
        7⤵
        
        PID:15608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38764.exe
        6⤵
        
        PID:10016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9844.exe
        6⤵
        
        PID:14852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14789.exe
        6⤵
        
        PID:6576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1545.exe
        5⤵
        
        PID:7136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11069.exe
        6⤵
        
        PID:9400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47006.exe
        6⤵
        
        PID:13852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47498.exe
        6⤵
        
        PID:3220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15485.exe
        6⤵
        
        PID:15972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63020.exe
        5⤵
        
        PID:9256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20800.exe
        5⤵
        
        PID:13736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19410.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49818.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49818.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45610.exe
        5⤵
        
        PID:5520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29523.exe
        6⤵
        
        PID:7720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25159.exe
        7⤵
        
        PID:10156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21384.exe
        7⤵
        
        PID:14824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17841.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8512.exe
        7⤵
        
        PID:17196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16559.exe
        6⤵
        
        PID:10684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50104.exe
        6⤵
        
        PID:15796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10809.exe
        5⤵
        
        PID:8808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11209.exe
        6⤵
        
        PID:12408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9620.exe
        6⤵
        
        PID:13720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18427.exe
        5⤵
        
        PID:12992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31125.exe
        5⤵
        
        PID:16772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11576.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11576.exe
      4⤵
      PID:5928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16311.exe
        5⤵
        
        PID:6936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59346.exe
        6⤵
        
        PID:10412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17841.exe
        6⤵
        
        PID:14888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8512.exe
        6⤵
        
        PID:17172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42433.exe
        5⤵
        
        PID:9924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47661.exe
        5⤵
        
        PID:17328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17197.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17197.exe
      4⤵
      PID:7196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55008.exe
        5⤵
        
        PID:10052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50597.exe
        5⤵
        
        PID:14384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60410.exe
        5⤵
        
        PID:1436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49669.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49669.exe
      4⤵
      PID:10672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9706.exe
      4⤵
      PID:15000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20376.exe
      4⤵
      PID:17064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9387.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9387.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27774.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27774.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24121.exe
        5⤵
        
        PID:5564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12034.exe
        6⤵
        
        PID:6860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63050.exe
        7⤵
        
        PID:9424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6820.exe
        7⤵
        
        PID:14744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58962.exe
        6⤵
        
        PID:7932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12459.exe
        6⤵
        
        PID:16244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-612.exe
        5⤵
        
        PID:7400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22946.exe
        6⤵
        
        PID:14540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15485.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57513.exe
        5⤵
        
        PID:11180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59913.exe
        5⤵
        
        PID:15544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1545.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1545.exe
      4⤵
      PID:7144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63050.exe
        5⤵
        
        PID:10640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6820.exe
        5⤵
        
        PID:2204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55507.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55507.exe
      4⤵
      PID:9556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41291.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41291.exe
      4⤵
      PID:560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5115.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5115.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58739.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58739.exe
      4⤵
      PID:5984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25932.exe
        5⤵
        
        PID:7256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7862.exe
        6⤵
        
        PID:9600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64110.exe
        6⤵
        
        PID:14328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29684.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25028.exe
        5⤵
        
        PID:9952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39301.exe
        5⤵
        
        PID:16308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46492.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46492.exe
      4⤵
      PID:9284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56680.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56680.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23201.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23201.exe
      4⤵
      PID:4964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30874.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30874.exe
      4⤵
      PID:16268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12711.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12711.exe
      4⤵
      PID:14916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49237.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49237.exe
    3⤵
    PID:4548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59481.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59481.exe
      4⤵
      PID:5076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63050.exe
        5⤵
        
        PID:10252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6820.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42433.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42433.exe
      4⤵
      PID:8252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59913.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59913.exe
      4⤵
      PID:16820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51703.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51703.exe
    3⤵
    PID:8152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9014.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9014.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52242.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52242.exe
      4⤵
      PID:14940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40315.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40315.exe
    3⤵
    PID:10872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57770.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57770.exe
    3⤵
    PID:16412
- C:\Users\Admin\AppData\Local\Temp\Unicorn-809.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-809.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22154.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22154.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56362.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56362.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26067.exe
        5⤵
        
        PID:5780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4250.exe
        6⤵
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61531.exe
        7⤵
        
        PID:9772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60234.exe
        8⤵
        
        PID:3488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48978.exe
        8⤵
        
        PID:5248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16855.exe
        7⤵
        
        PID:13440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15485.exe
        7⤵
        
        PID:16848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9268.exe
        6⤵
        
        PID:10164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4682.exe
        6⤵
        
        PID:3712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53020.exe
        5⤵
        
        PID:3008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24531.exe
        6⤵
        
        PID:12532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9620.exe
        6⤵
        
        PID:3076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41753.exe
        5⤵
        
        PID:11856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27171.exe
        5⤵
        
        PID:16056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55337.exe
        5⤵
        
        PID:10400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52195.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52195.exe
      4⤵
      PID:6052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37115.exe
        5⤵
        
        PID:5492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28667.exe
        6⤵
        
        PID:8704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1889.exe
        6⤵
        
        PID:13324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15485.exe
        6⤵
        
        PID:15596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42241.exe
        5⤵
        
        PID:10040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64332.exe
        5⤵
        
        PID:12936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10000.exe
        5⤵
        
        PID:14008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32136.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32136.exe
      4⤵
      PID:8016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11318.exe
        5⤵
        
        PID:11012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9620.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16507.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16507.exe
      4⤵
      PID:11404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64374.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64374.exe
      4⤵
      PID:16148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63139.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63139.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21551.exe
      4⤵
      PID:7080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28475.exe
        5⤵
        
        PID:9368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53420.exe
        5⤵
        
        PID:14116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39623.exe
        5⤵
        
        PID:16064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-855.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-855.exe
      4⤵
      PID:8928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50078.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50078.exe
      4⤵
      PID:13712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31125.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31125.exe
      4⤵
      PID:16764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-393.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-393.exe
    3⤵
    PID:6036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32346.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32346.exe
      4⤵
      PID:6824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63050.exe
        5⤵
        
        PID:10152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47661.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42433.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42433.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15372.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15372.exe
      4⤵
      PID:16164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39756.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39756.exe
    3⤵
    PID:7496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2740.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2740.exe
      4⤵
      PID:3052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9620.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9620.exe
      4⤵
      PID:3644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30307.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30307.exe
      4⤵
      PID:12208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40899.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40899.exe
    3⤵
    PID:12008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62965.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62965.exe
    3⤵
    PID:5836
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34712.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34712.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2200.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2200.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45610.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45610.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57945.exe
        5⤵
        
        PID:7012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60955.exe
        6⤵
        
        PID:7064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1889.exe
        6⤵
        
        PID:13316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30098.exe
        5⤵
        
        PID:8040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44213.exe
        5⤵
        
        PID:13696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21058.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21058.exe
      4⤵
      PID:5992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23275.exe
        5⤵
        
        PID:6116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17986.exe
        5⤵
        
        PID:12448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15485.exe
        5⤵
        
        PID:15980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54140.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54140.exe
      4⤵
      PID:8876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21489.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21489.exe
      4⤵
      PID:13424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38873.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38873.exe
    3⤵
    PID:5972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37115.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37115.exe
      4⤵
      PID:5740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40727.exe
        5⤵
        
        PID:8520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9865.exe
        5⤵
        
        PID:13748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17456.exe
        5⤵
        
        PID:15272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60410.exe
        5⤵
        
        PID:1256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42433.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42433.exe
      4⤵
      PID:5080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59913.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59913.exe
      4⤵
      PID:4656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32136.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32136.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:8008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41194.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41194.exe
      4⤵
      PID:10316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29684.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29684.exe
      4⤵
      PID:4088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57137.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57137.exe
      4⤵
      PID:10488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63186.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63186.exe
    3⤵
    PID:10608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31125.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31125.exe
    3⤵
    PID:16780
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51317.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51317.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26067.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26067.exe
    3⤵
    PID:5788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37115.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37115.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63050.exe
        5⤵
        
        PID:10048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51745.exe
        5⤵
        
        PID:17340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42433.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42433.exe
      4⤵
      PID:9708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3979.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3979.exe
      4⤵
      PID:2984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18880.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18880.exe
      4⤵
      PID:15488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64015.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64015.exe
    3⤵
    PID:9120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17659.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17659.exe
    3⤵
    PID:11912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55580.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55580.exe
    3⤵
    PID:14244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31125.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31125.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:16716
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27781.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27781.exe
  2⤵
  PID:6076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48298.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48298.exe
    3⤵
    PID:5832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28475.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28475.exe
      4⤵
      PID:9360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53420.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53420.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34368.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34368.exe
      4⤵
      PID:13884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15485.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15485.exe
      4⤵
      PID:15904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42433.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42433.exe
    3⤵
    PID:9768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35583.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35583.exe
    3⤵
    PID:15040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10759.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10759.exe
    3⤵
    PID:9432
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8336.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8336.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35159.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35159.exe
    3⤵
    PID:14900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47468.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47468.exe
    3⤵
    PID:14896
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47043.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47043.exe
  2⤵
  PID:11000
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59242.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59242.exe
  2⤵
  PID:4472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 13884 -ip 13884
1⤵
PID:14704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 13884 -ip 13884
1⤵
PID:14852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 14312 -ip 14312
1⤵
PID:4296

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11133.exe

Filesize
468KB

MD5
c369bfebc7c4f471163039476388b8e9

SHA1
53299a418250268c30626cf06bd82358cae8355f

SHA256
9e551e7fb5d2ca57fdf674949d447299eb096424c69fd61ce52c6f8ca9219595

SHA512
9b249cc040cc44eb309243cb3b90d8d95c87d64cbd317c235b6dfa07a176d18f97c8995528041daa8633f323d0eedbd203a292e9ee8d3041c42ca0fce8e01907

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13636.exe

Filesize
468KB

MD5
f6712ce1212544307511e315d5f4f11f

SHA1
52c1986ec6ba4b67eb76e5886b756b60db49919b

SHA256
033d0588f881799c3af7c5c2276e1889e49d37c9535580a2ff6d423c1b124944

SHA512
cfbd6c4eb3d78c652e93309a5570c2b3187ded3ecd16e231e8388235473449d64700c7ba98c0766d1e843c5c75b8a631784d59397214e662ac5466281ee45b70

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15547.exe

Filesize
468KB

MD5
c1b29d03f84367607aba1970693550c3

SHA1
36f3c354fb96ea664cb1dc9d9304c2cd96e79ebf

SHA256
c209f04af3566b3a56499323d10d68a019b59d4959f2e6a7ac82d281519a36dd

SHA512
595fbb6992dd24f99307ff2c8cf7b2c660d348822e765831e6f41a0ee4e8d0583e75699adf2e0de6c4745da413173b4d0913dfb345c0c4e778dca408bccdbd29

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20408.exe

Filesize
468KB

MD5
6340ff1e1c312f22bd191a22175f6b09

SHA1
e795a7b0291179e9890c4991b8d8cf62e4589730

SHA256
73544099432cf5671a360ccb439e5868e5f43620487c093bae63236d01c72a70

SHA512
38284bd1c70914d5244b849097867bf5593bb2554382a76b8b9b07f2772dbcdb4e8c233a7e8d374ea831c634856d8c14cb48be2a95daeca67942e1bbd237127f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21255.exe

Filesize
468KB

MD5
3d39ec3a52f1f674dc283564696b7f86

SHA1
2970ea781189902b939a55f0b59b1f41c5feacaf

SHA256
919cbaa165060e466755ed84b77a805e7c02a4243f6031171e8388a57b2a0b2a

SHA512
092d8a0a3cf9c95be5be0b6101f75e30d4e5ca932c9b149eab83991afcbf47ab86679b587d93042f1358344630d62b79fc69d00b459f0f9fcf428e9c7b2f3700

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21495.exe

Filesize
468KB

MD5
1a7fe0384d69a7e51ecb08252b251255

SHA1
a9adb229c6e40d8b9ed4f7b6102ebe8eddf45a07

SHA256
f4bc506e5c4edf72918fcc67dedbd0ef30ad492924296571e63429e39c433481

SHA512
52b238ba73d1a9120fc133867e6efcabaf503cf547ffa473e46cb7d6fe0fd98b3864e7813348d8993f31e20851b5c9da524929951c03d2bd1bee5aef4da48bdb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22154.exe

Filesize
468KB

MD5
6959bd7c27acfebf6b4adee75cac14e8

SHA1
a05db872efb4ee5ffdc9a1ba8ac6f72f967f446d

SHA256
58c8d38f9ac4e827463a245ffb235bca0c91c35e254a8961cd7fe1a31f48b0cf

SHA512
4658b10a8ed26083f198d42c66a5bc301583c4b32e960c7b1c06c43bc9dcd4712e149e8ed0f394dd2e979ebc6b65deefe03537151b9b50cc666f6222de9e4c6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23122.exe

Filesize
468KB

MD5
c03021d161f1b212101a3cf13401f73e

SHA1
a7026d97bfb705e586433c66b0099779d3df1366

SHA256
cdba7f08477d7c1e88158c72795f4e408cd4f63b58302a96316b7dd15c54eeb2

SHA512
a460449da2219fe24ac8a8fde47642b1bb6957ffc99b0f0fc63422588c9817fa1936a74b23176f378e0defa03145086bfee2028c508b81411d203359b1a4d14e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23851.exe

Filesize
468KB

MD5
6dc1c67db228ffec6e1cd6a65180dddf

SHA1
151e327c94bf5dc86326075176d6bd9b4cc5c068

SHA256
497ae710d7898a0d1635eda1ecd175c547bee7c66a2ea2fe7da2e6ea7c9a4108

SHA512
8e67d0660198436f9f957a6e52689a5c4ef8484300f299a6d816b70b7e4d407af13b76da4735a25b84804651f8bee4afac804a9579fc12f7a21175bf9064e80d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26713.exe

Filesize
468KB

MD5
28e514b37d2de614320029cfa6b3a71f

SHA1
5acefc283025c9ebcf960e0dafda68eb237328fe

SHA256
cc8639c31019de1eade0bae1c7f1284fb6f627aa558283d42bcb7746616d6ab8

SHA512
76f1f3afebc3d49bf832f4189769627880dc1f787547f28a746cbfa8a257ac8002cf07aafdcba1b0770e2dee991ab082b8028811cb0704255474b60a84f2dbe0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2781.exe

Filesize
468KB

MD5
5dca542f0e2ca003e36c49ef5e6a231f

SHA1
cef3353757ab35e98e021562286ad8de46f2d26e

SHA256
ea85cc99a5a86421644f1a1f20ccd95a4036552b1aef1231e474844fa735e670

SHA512
154faa7cf327e379d5441018f8636d3f05d3002bad8fbebf31c4688a5facfeaf651598317131ebf461594152bf52a2cd0aea8cef4d6a18af9304773c7fe99627

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28271.exe

Filesize
468KB

MD5
b621a3318069dd32c4fc67505aa8066a

SHA1
44c8d9bd60246239e2741348a0f92ae73c68544c

SHA256
3ce3ed103cb76ae51fc917a155977374004b7f283505d03adec7ac204d959923

SHA512
87d4de6732e38c066749f1941e2e8e791db2c5b0dc8c039f945f2e02944138f2325455c139adffa26c3bf852c38576154e952e415f00fcd78eb727d0efdfa77d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29963.exe

Filesize
468KB

MD5
c60a08ea407d279a56a8b6179e1ade20

SHA1
800d77453b49280ae6abc9a291fd06eae71c4c77

SHA256
cb927f57cd072bd55d377524ae1ee810b571ffcf526fc2e1256ccbdcac66115f

SHA512
5e3499a8fbbf3e20f4c9f8df7186f8d7c093431c1744ecf1245bdcc94dff92091615e432a069655ed430c77e2087f5836900f915ac4f5ddb739dd60b35240f61

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34712.exe

Filesize
468KB

MD5
968417b04b3d152cb5e62315f6441c4d

SHA1
e1e96a7217b8e1dfb2acec929e8810bc1028eb2e

SHA256
7eada88c0bfe829f983ce12ca84b0bccdcf1bcca0e5361787109197d3d3d845c

SHA512
59b6b67a56813fa033087b8d9f28c25f7141dd508173b3e2218062c62b6933d01df95234468189dde72be8db3718197479af5743ad6a0e762349f7a4c146410f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35083.exe

Filesize
468KB

MD5
d126f0b35e044cf08a1a900b3a2a7d62

SHA1
defea21f7d6aff9ed0753d8005bcf65f6bce36c8

SHA256
8ee1a5ea923ad5939b56320a3ad253495b3a255f1bc770837ccdda6b35f29aae

SHA512
7874e8119e0c2b06334e822faf7fa4994ba1ea852237aa82992f11851376a1c30c22972aca312d2c60716d1b18dda134566575a5a20e327ea50cc2962c14becf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36928.exe

Filesize
468KB

MD5
74a100f7d5870bdc111df7c081a00dd4

SHA1
83d6e14094ac38cfbd0ffc4c29db50e5ebaaaf00

SHA256
c36114fa71df097cd00e0a58b165779f0b994a23cc0142c56287ff28bbef09a1

SHA512
e97875b4756f79c57901e6d691ded8dabde6a8ced18ae5edda8a4d71aef397179c699c47730220fe6d10f5dab3da49d4dca1ca936b7c4356aba626b4546ee9b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38023.exe

Filesize
468KB

MD5
96dd8127766132ab30563d9b41da85b7

SHA1
3e1a6bb29d8e3a954efde09e43d19df0e4daff55

SHA256
6bc2c7e7044fa2797415b3ff90632c6dfd66a6d7c3dd9ad7b4ada849efb434a9

SHA512
9a58f965159bf418fcd3f0a65d756ad87689ea254fa47bfe84688e1c129e5d1ec13188a19496366566e99df20e58c2e277287be85a2c00dde86dc0ede3c4fdbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38795.exe

Filesize
468KB

MD5
2843dcf8cf9aa9ba9e3d6e5c29282609

SHA1
28fa09d66f396ca4e32313b16372341168dd55fb

SHA256
272d52a7c23420b4aee65c067b0932eac17202d768b34cd1f62fe822b9ea0f2c

SHA512
0623d334ffdc3cfddc337a1ee9436dc150c5a5e5fc42f83b32b7602ef6e2275144fcf58859a602790e0134b944f64654cdcc0412eb6cd91510c6b193a466a401

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-399.exe

Filesize
468KB

MD5
dbb975cb497b5a839b0b0c2f5afe6bae

SHA1
d566546167874e4aa5e77c7e8a15515c19d63d39

SHA256
183d35a87484bad7583897c590308b9d04c7190bb843c2def8ab11eb57620ff8

SHA512
b85d5474a40b5685277d2b335983d60f72dead487cbb2f58fc3256f65be4ba5ec4689b37d76b817217dc2af59748220bd45cef643194dd82c5802c2446096b0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41053.exe

Filesize
468KB

MD5
b6c32ad206686c5c4073ceeccc898cd6

SHA1
1c472d830b18add8bb30438c1f31cb4e3452f558

SHA256
4517cd1c477f6ad47957e0292b4f3bfa20869dffce264a5ca5e3e212ae9ada54

SHA512
28a88df43ae53c607bad1d312b4d22e175f157a93788b3905aeba87942918fbb71c522a7ca3d406fae57644c41a69393efb85be998726ae9fb92b511db174986

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41121.exe

Filesize
468KB

MD5
ee16a310c2d525b14f9f90689910b858

SHA1
639d23920845215afa02f1acf0b0c8168ed3488b

SHA256
b0f83cdd3fe532350383f99816f9f660437c914eb6f9589741022a5ecf269e9d

SHA512
344a4878fa30950c3e7e05a1f03f14f6b42a50460d66590adada43dfe32aea8db796e38b292996fbc771b9eacad3bd3bc75d433ce643213b521251f6d19065de

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46336.exe

Filesize
468KB

MD5
23e1f8d62e98876fdb90633d1013a8c0

SHA1
feed8a4f4c5c216487c8e2748d9eb67440bcc5ed

SHA256
717f5a3c8089641f2080fa1e718de4f0575bf41604b02588bd0b06cc4ac9a147

SHA512
97c4b28f59f98d319abd60f7008b7e83c2661070b21a053095a29a691f9ad36a575bae4f5f15d734f16c5395d68b86843213293015ce4a766842a8b3199bd8be

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46409.exe

Filesize
468KB

MD5
e88bce4b590f8bbd20da02e4ab98112e

SHA1
5b5e77a8d6272f8d94b815077c8259974e9b4ddd

SHA256
a7e3cd8b88768547739c54de088401e80974ca928c499aa07b77bb823d3790a7

SHA512
ae621f882f22d847824ddc94dc5e7c13d8a07ce7715439cb4e7444eb1b1fa53306d4448b0da80cfa8724764394b267d133cc5c485a65316ae054329539d25f61

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46746.exe

Filesize
468KB

MD5
6e15f721d029729be2e59f710165dd91

SHA1
f9879dcbbdbf0c6b4a20dfbab31a6c3cfc741136

SHA256
71beb7e72460b89791eb51b4a71e631255f1858f046252c5fe261aa13fe5f205

SHA512
fb8887226d0f1deea0735a1a1ecd9f7ad069a7dbfd82260f2d1af9053f29b1e4773da0a3fed30233043fd42a39a660bc7420f2de797e31b3a55c878667368df1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50459.exe

Filesize
468KB

MD5
e508ce30c61d674ec5f108290eaf2d5e

SHA1
70d1685e00ad8a85831ace64d0c677f44455beb8

SHA256
f9d0dec106f99ef60316a6aa4c7ecc413113d8233954a1e23bc521f239e640f2

SHA512
c74d96ac8beb5abb8f1c18ac02104a15b23a6a375fde8414dd15dbbaf797a79717d6711b636814591b506b236474b9cb912a3bbae03cb25ed7d56f3b77a437bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56305.exe

Filesize
468KB

MD5
3b3133f49f8ca4da92240398998c1eda

SHA1
227cd11350990455c155601958e32092ed9a27b2

SHA256
8b273def4ef04e0010351d0163db0baa38447252c8df887e8d91d341ad444e6f

SHA512
22ca83d34f781436bf125c799ff233c243be893721aed5049ba1bdd4d40a22e99de8f1a493bf5df9100e0e04b2a761561dabc6569003a37717b9e7ae5bf652ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57047.exe

Filesize
468KB

MD5
7e02c6d4b932f100cfa0e7a6738037ea

SHA1
bec5038ee69c20535f57445225c310dd8bb733c7

SHA256
ea64f476f47ea8150226d178533f6864254f5efcbed76b0c7f2de181246c9c81

SHA512
17a30dd7e03e6a98763fa2d83a7edc833c9f30a6700725be5cbcb9dbf4017d9b935f2a622007b755b42e083053d8286bddcffcb1b3f85564d50a9335ff196c22

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59979.exe

Filesize
468KB

MD5
bcf790afc5877ee668e94ed52e9adc37

SHA1
15baf63d514db57ef119179aac384461573087eb

SHA256
3670fa9280158a737738b899d644be053257e7dbb0ac8411ca9fb7e25c2fa2b0

SHA512
dbea715c8b0ba0d2be6bd92544482ebe82e26c758b1471ff065b91f471faaf964b1d2847ca0af9879c38f87f0a994f0815cf69315db2bcc2ae3bc6563ab63479

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60481.exe

Filesize
468KB

MD5
5d54e33f00aa58ab9bac92c4d2b75235

SHA1
8caa5180b53c51274dd617ac7c49f9ae08e7fb5f

SHA256
c01c3d9f1052e64ff979caf9695b5ddd648430fecb53c5a7a12cafae3e8a371f

SHA512
dd5dc5b0c0f0684a23990bc853d5b66614b9d063914fe4633f032c8abd6f3c6cfd88352288000b44069b666a97189f46a1f241d92f4c28faeaf7a3589e8da6fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6118.exe

Filesize
468KB

MD5
83d534fdce96c4df60d3f43d082f588d

SHA1
279538b6b17e78cd65f90fe0717f6fa7063e07b4

SHA256
42256317f16eaf536ce017ad39df77fa425abf25c29765bde4e05420b84f1917

SHA512
1973f9777713af99acd09617dd4543356830645e9de87bf097aadec2d654086545c31e99b56fd31bb8154b8f1876824e138f4b8156fdfae4cb6d6f753670d259

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7270.exe

Filesize
468KB

MD5
8528fcf7211a130b00634f017a52af2c

SHA1
515ad0bb7d47fc4ce2cbe10a051d86095e515fc5

SHA256
a48df5fac43fba7d9bbd8a4eded1825c1ce29a95f17577606f12d3233a658d0b

SHA512
54054b7527531fee68e9f62776eba9714978f0012568e7d45a655fafc404be7b54008e3de74a60272f9c1e747e97b099b95baddc4f88a8e2f549010074462850

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-809.exe

Filesize
468KB

MD5
16e18296bc5f43e130b0b925eb1ff309

SHA1
49dd62e62937a84fda59b710a1a48f5f122bb791

SHA256
62ea7f3b17bafc1687787533bac57c07ea877487c8046907707b6d1abc058cd1

SHA512
634ba9af979ecc2786c0448a05640769ee555aefd11378b8e2837ceb1222ac34a7479cd0c39275d7ff342479ce6d0912b18ed8ec561e9a06ba4311ed08c861b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9387.exe

Filesize
468KB

MD5
d1269415259e8268e8a9c85dc115982d

SHA1
a997ea2c8d56b8260ad9bb4fcc61c10001546a0d

SHA256
499dab0468c294f99be0408eb5d329a7d98e439baf5e62d7dd796048ddac5c36

SHA512
757e9e43c063f65b34670f0ed691fe95de33cd89dc4b43c5a49ebdc3c271b72aab548c83fed9a81af522004676bd289f0f728376b15b26a79b5982edceb6328b

Download Submit
memory/228-260-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/372-42-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/384-363-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/412-333-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/812-246-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1060-348-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1076-228-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1124-335-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1168-382-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1172-124-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1176-135-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1196-299-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1532-44-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1536-300-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1540-163-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1544-245-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1644-354-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1840-111-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1936-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2136-238-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2216-251-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2272-380-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2316-165-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2356-101-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2464-233-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2572-332-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2792-330-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2880-275-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2896-83-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2988-183-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3080-334-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3108-177-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3136-100-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3148-364-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3240-217-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3284-345-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3420-353-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3520-327-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3756-176-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3772-19-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3812-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3984-63-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4036-175-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4052-381-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4076-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4104-225-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4124-378-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4184-305-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4240-379-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4312-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4356-347-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4436-123-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4480-212-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4484-37-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4520-401-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4544-102-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4612-107-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4676-342-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4680-276-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4748-82-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4796-400-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4844-55-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4852-331-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4880-290-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4904-202-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4924-287-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5040-161-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5068-148-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5152-409-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5168-412-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5228-417-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5264-428-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5288-429-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5308-430-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5364-441-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5396-442-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5464-451-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5484-462-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5512-463-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5548-477-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5564-480-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5584-481-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5596-492-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5636-484-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5668-486-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5676-497-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5708-493-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5796-494-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5868-565-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5928-599-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5948-600-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5984-601-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6000-602-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6036-604-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6044-605-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6052-606-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14008-2506-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14616-2802-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15040-2475-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads