3f2951aea07fc73f8c813919d1871926b27518e2983f3ccf0be49cdf693e2d68

Analysis

max time kernel
119s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 10:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

273c5ff8dc2d0b5c0cca429d0eb3d480N.exe
Size

468KB
MD5

273c5ff8dc2d0b5c0cca429d0eb3d480
SHA1

f1e26ab4c519dd155d50494c59eeb85c9c064513
SHA256

3f2951aea07fc73f8c813919d1871926b27518e2983f3ccf0be49cdf693e2d68
SHA512

559380bb92931be55514310a5133fef9174dcdf2a4e616bdd7f2da84b78fdc6aeaede380b66aaf6a43cf8437d2d9342cdd6080a9f1daebcd71024a33af7f1c72
SSDEEP

3072:W1N/ogLd958nn+/SPz5FafwcfKzWI8JnmHe0V3kH2WaCbFN4wlC:W11oaqnnBP1FaffxPLH2FQFN4

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2416	Unicorn-10234.exe
1048	Unicorn-45211.exe
32	Unicorn-62102.exe
1688	Unicorn-47323.exe
4536	Unicorn-177.exe
4900	Unicorn-61075.exe
4532	Unicorn-63113.exe
1104	Unicorn-42767.exe
3080	Unicorn-18817.exe
4240	Unicorn-34407.exe
2536	Unicorn-47214.exe
3744	Unicorn-60949.exe
3776	Unicorn-1542.exe
2056	Unicorn-42383.exe
184	Unicorn-50286.exe
440	Unicorn-53047.exe
3900	Unicorn-20929.exe
2588	Unicorn-36711.exe
1164	Unicorn-50809.exe
4308	Unicorn-11822.exe
1580	Unicorn-41157.exe
4052	Unicorn-45839.exe
2928	Unicorn-62730.exe
4172	Unicorn-49731.exe
4952	Unicorn-51769.exe
1036	Unicorn-41563.exe
2068	Unicorn-37479.exe
880	Unicorn-12782.exe
5016	Unicorn-16104.exe
4816	Unicorn-24770.exe
3176	Unicorn-42117.exe
3244	Unicorn-56083.exe
4204	Unicorn-48278.exe
3800	Unicorn-16011.exe
1844	Unicorn-40515.exe
924	Unicorn-56851.exe
3624	Unicorn-32901.exe
3672	Unicorn-40058.exe
1852	Unicorn-61298.exe
660	Unicorn-9496.exe
772	Unicorn-36793.exe
1096	Unicorn-64827.exe
1504	Unicorn-38085.exe
1136	Unicorn-12097.exe
4460	Unicorn-4718.exe
1848	Unicorn-58003.exe
2532	Unicorn-53919.exe
2164	Unicorn-45294.exe
3768	Unicorn-16208.exe
112	Unicorn-33307.exe
3932	Unicorn-8610.exe
4528	Unicorn-2480.exe
2508	Unicorn-4526.exe
2496	Unicorn-12694.exe
1980	Unicorn-59849.exe
3328	Unicorn-25501.exe
3004	Unicorn-45367.exe
4440	Unicorn-65018.exe
5092	Unicorn-9165.exe
3100	Unicorn-30161.exe
2080	Unicorn-54666.exe
2792	Unicorn-33691.exe
2348	Unicorn-49835.exe
2664	Unicorn-15116.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
7580	5124	WerFault.exe	206

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58003.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31897.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42371.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56916.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61075.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36003.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40435.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12388.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17275.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22889.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49582.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9730.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54726.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32748.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60983.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16948.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16344.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25931.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16833.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46314.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36176.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8881.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25481.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63614.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59526.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58587.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14688.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23849.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-729.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32577.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17653.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14542.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41662.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36173.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48425.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49401.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35333.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60891.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54970.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35201.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48278.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6382.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16873.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-66.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48167.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11021.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40429.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5156.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51502.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34218.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53663.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34129.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5724.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17557.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7070.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15074.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37792.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21166.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17865.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52217.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32412.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59526.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45323.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	2864	dwm.exe
Token: SeChangeNotifyPrivilege	2864	dwm.exe
Token: 33	2864	dwm.exe
Token: SeIncBasePriorityPrivilege	2864	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2740	273c5ff8dc2d0b5c0cca429d0eb3d480N.exe
2416	Unicorn-10234.exe
1048	Unicorn-45211.exe
32	Unicorn-62102.exe
1688	Unicorn-47323.exe
4536	Unicorn-177.exe
4900	Unicorn-61075.exe
4532	Unicorn-63113.exe
1104	Unicorn-42767.exe
3080	Unicorn-18817.exe
4240	Unicorn-34407.exe
2536	Unicorn-47214.exe
2056	Unicorn-42383.exe
3776	Unicorn-1542.exe
184	Unicorn-50286.exe
3744	Unicorn-60949.exe
3900	Unicorn-20929.exe
440	Unicorn-53047.exe
2588	Unicorn-36711.exe
1164	Unicorn-50809.exe
4308	Unicorn-11822.exe
1580	Unicorn-41157.exe
4052	Unicorn-45839.exe
2928	Unicorn-62730.exe
4172	Unicorn-49731.exe
4952	Unicorn-51769.exe
3176	Unicorn-42117.exe
5016	Unicorn-16104.exe
2068	Unicorn-37479.exe
1036	Unicorn-41563.exe
880	Unicorn-12782.exe
4816	Unicorn-24770.exe
3244	Unicorn-56083.exe
4204	Unicorn-48278.exe
3800	Unicorn-16011.exe
1844	Unicorn-40515.exe
924	Unicorn-56851.exe
3672	Unicorn-40058.exe
3624	Unicorn-32901.exe
1852	Unicorn-61298.exe
660	Unicorn-9496.exe
1504	Unicorn-38085.exe
772	Unicorn-36793.exe
1096	Unicorn-64827.exe
4460	Unicorn-4718.exe
1848	Unicorn-58003.exe
2532	Unicorn-53919.exe
1136	Unicorn-12097.exe
3328	Unicorn-25501.exe
1980	Unicorn-59849.exe
2508	Unicorn-4526.exe
3768	Unicorn-16208.exe
112	Unicorn-33307.exe
2496	Unicorn-12694.exe
2164	Unicorn-45294.exe
3004	Unicorn-45367.exe
3932	Unicorn-8610.exe
4440	Unicorn-65018.exe
4528	Unicorn-2480.exe
5092	Unicorn-9165.exe
3100	Unicorn-30161.exe
2348	Unicorn-49835.exe
2664	Unicorn-15116.exe
2080	Unicorn-54666.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 2416	2740	273c5ff8dc2d0b5c0cca429d0eb3d480N.exe	89
PID 2740 wrote to memory of 2416	2740	273c5ff8dc2d0b5c0cca429d0eb3d480N.exe	89
PID 2740 wrote to memory of 2416	2740	273c5ff8dc2d0b5c0cca429d0eb3d480N.exe	89
PID 2416 wrote to memory of 1048	2416	Unicorn-10234.exe	92
PID 2416 wrote to memory of 1048	2416	Unicorn-10234.exe	92
PID 2416 wrote to memory of 1048	2416	Unicorn-10234.exe	92
PID 2740 wrote to memory of 32	2740	273c5ff8dc2d0b5c0cca429d0eb3d480N.exe	93
PID 2740 wrote to memory of 32	2740	273c5ff8dc2d0b5c0cca429d0eb3d480N.exe	93
PID 2740 wrote to memory of 32	2740	273c5ff8dc2d0b5c0cca429d0eb3d480N.exe	93
PID 1048 wrote to memory of 1688	1048	Unicorn-45211.exe	96
PID 1048 wrote to memory of 1688	1048	Unicorn-45211.exe	96
PID 1048 wrote to memory of 1688	1048	Unicorn-45211.exe	96
PID 2416 wrote to memory of 4536	2416	Unicorn-10234.exe	98
PID 2416 wrote to memory of 4536	2416	Unicorn-10234.exe	98
PID 2416 wrote to memory of 4536	2416	Unicorn-10234.exe	98
PID 32 wrote to memory of 4900	32	Unicorn-62102.exe	99
PID 32 wrote to memory of 4900	32	Unicorn-62102.exe	99
PID 32 wrote to memory of 4900	32	Unicorn-62102.exe	99
PID 2740 wrote to memory of 4532	2740	273c5ff8dc2d0b5c0cca429d0eb3d480N.exe	100
PID 2740 wrote to memory of 4532	2740	273c5ff8dc2d0b5c0cca429d0eb3d480N.exe	100
PID 2740 wrote to memory of 4532	2740	273c5ff8dc2d0b5c0cca429d0eb3d480N.exe	100
PID 1688 wrote to memory of 1104	1688	Unicorn-47323.exe	101
PID 1688 wrote to memory of 1104	1688	Unicorn-47323.exe	101
PID 1688 wrote to memory of 1104	1688	Unicorn-47323.exe	101
PID 1048 wrote to memory of 3080	1048	Unicorn-45211.exe	102
PID 1048 wrote to memory of 3080	1048	Unicorn-45211.exe	102
PID 1048 wrote to memory of 3080	1048	Unicorn-45211.exe	102
PID 4536 wrote to memory of 4240	4536	Unicorn-177.exe	103
PID 4536 wrote to memory of 4240	4536	Unicorn-177.exe	103
PID 4536 wrote to memory of 4240	4536	Unicorn-177.exe	103
PID 32 wrote to memory of 2536	32	Unicorn-62102.exe	104
PID 32 wrote to memory of 2536	32	Unicorn-62102.exe	104
PID 32 wrote to memory of 2536	32	Unicorn-62102.exe	104
PID 2416 wrote to memory of 3744	2416	Unicorn-10234.exe	105
PID 2416 wrote to memory of 3744	2416	Unicorn-10234.exe	105
PID 2416 wrote to memory of 3744	2416	Unicorn-10234.exe	105
PID 4900 wrote to memory of 3776	4900	Unicorn-61075.exe	106
PID 4900 wrote to memory of 3776	4900	Unicorn-61075.exe	106
PID 4900 wrote to memory of 3776	4900	Unicorn-61075.exe	106
PID 4532 wrote to memory of 2056	4532	Unicorn-63113.exe	107
PID 4532 wrote to memory of 2056	4532	Unicorn-63113.exe	107
PID 4532 wrote to memory of 2056	4532	Unicorn-63113.exe	107
PID 2740 wrote to memory of 184	2740	273c5ff8dc2d0b5c0cca429d0eb3d480N.exe	108
PID 2740 wrote to memory of 184	2740	273c5ff8dc2d0b5c0cca429d0eb3d480N.exe	108
PID 2740 wrote to memory of 184	2740	273c5ff8dc2d0b5c0cca429d0eb3d480N.exe	108
PID 1104 wrote to memory of 440	1104	Unicorn-42767.exe	109
PID 1104 wrote to memory of 440	1104	Unicorn-42767.exe	109
PID 1104 wrote to memory of 440	1104	Unicorn-42767.exe	109
PID 1688 wrote to memory of 3900	1688	Unicorn-47323.exe	110
PID 1688 wrote to memory of 3900	1688	Unicorn-47323.exe	110
PID 1688 wrote to memory of 3900	1688	Unicorn-47323.exe	110
PID 3080 wrote to memory of 2588	3080	Unicorn-18817.exe	111
PID 3080 wrote to memory of 2588	3080	Unicorn-18817.exe	111
PID 3080 wrote to memory of 2588	3080	Unicorn-18817.exe	111
PID 1048 wrote to memory of 1164	1048	Unicorn-45211.exe	112
PID 1048 wrote to memory of 1164	1048	Unicorn-45211.exe	112
PID 1048 wrote to memory of 1164	1048	Unicorn-45211.exe	112
PID 4240 wrote to memory of 4308	4240	Unicorn-34407.exe	113
PID 4240 wrote to memory of 4308	4240	Unicorn-34407.exe	113
PID 4240 wrote to memory of 4308	4240	Unicorn-34407.exe	113
PID 4536 wrote to memory of 1580	4536	Unicorn-177.exe	114
PID 4536 wrote to memory of 1580	4536	Unicorn-177.exe	114
PID 4536 wrote to memory of 1580	4536	Unicorn-177.exe	114
PID 2056 wrote to memory of 4052	2056	Unicorn-42383.exe	115

C:\Users\Admin\AppData\Local\Temp\273c5ff8dc2d0b5c0cca429d0eb3d480N.exe
"C:\Users\Admin\AppData\Local\Temp\273c5ff8dc2d0b5c0cca429d0eb3d480N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10234.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10234.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45211.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45211.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47323.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47323.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42767.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53047.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56083.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33691.exe
        8⤵
        Executes dropped EXE
        
        PID:2792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9002.exe
        9⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50331.exe
        10⤵
        
        PID:6760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28352.exe
        11⤵
        
        PID:11624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8192.exe
        11⤵
        
        PID:6408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23473.exe
        11⤵
        
        PID:8704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-149.exe
        10⤵
        
        PID:9200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61705.exe
        10⤵
        
        PID:12916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43827.exe
        10⤵
        
        PID:8088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32769.exe
        9⤵
        
        PID:7464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6382.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:1584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26966.exe
        10⤵
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61269.exe
        9⤵
        
        PID:10052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46294.exe
        9⤵
        
        PID:14580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57274.exe
        9⤵
        
        PID:17252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14601.exe
        8⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11410.exe
        9⤵
        
        PID:1440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46263.exe
        10⤵
        
        PID:13268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56899.exe
        10⤵
        
        PID:15628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34218.exe
        9⤵
        
        PID:11580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49217.exe
        9⤵
        
        PID:6604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3782.exe
        9⤵
        
        PID:10672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5472.exe
        8⤵
        
        PID:7500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24831.exe
        9⤵
        
        PID:12504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28310.exe
        9⤵
        
        PID:6616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34270.exe
        8⤵
        
        PID:10256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37628.exe
        8⤵
        
        PID:14532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6805.exe
        8⤵
        
        PID:8452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54666.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58203.exe
        8⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27363.exe
        9⤵
        
        PID:7360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43139.exe
        10⤵
        
        PID:13076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52130.exe
        10⤵
        
        PID:16984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2609.exe
        9⤵
        
        PID:9696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6448.exe
        9⤵
        
        PID:12732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5809.exe
        9⤵
        
        PID:15840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10620.exe
        8⤵
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3429.exe
        8⤵
        
        PID:12056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49417.exe
        8⤵
        
        PID:15256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7329.exe
        8⤵
        
        PID:9256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56541.exe
        7⤵
        
        PID:6392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40435.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51862.exe
        8⤵
        
        PID:13128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44786.exe
        8⤵
        
        PID:6644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4809.exe
        7⤵
        
        PID:1808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2356.exe
        7⤵
        
        PID:6576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20629.exe
        7⤵
        
        PID:2144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40539.exe
        7⤵
        
        PID:17260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32901.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64199.exe
        7⤵
        
        PID:3132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37185.exe
        8⤵
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1670.exe
        9⤵
        
        PID:9880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23849.exe
        9⤵
        
        PID:13868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35689.exe
        9⤵
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7497.exe
        8⤵
        
        PID:8744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58905.exe
        8⤵
        
        PID:12848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51190.exe
        8⤵
        
        PID:15892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59526.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47259.exe
        8⤵
        
        PID:9152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17653.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18445.exe
        8⤵
        
        PID:17288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55161.exe
        7⤵
        
        PID:7892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11021.exe
        7⤵
        
        PID:10060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8192.exe
        7⤵
        
        PID:6176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13972.exe
        6⤵
        
        PID:208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58587.exe
        7⤵
        
        PID:6464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17275.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51862.exe
        8⤵
        
        PID:13136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12881.exe
        8⤵
        
        PID:16296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50746.exe
        7⤵
        
        PID:2356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62525.exe
        7⤵
        
        PID:9732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31077.exe
        7⤵
        
        PID:6304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59282.exe
        6⤵
        
        PID:6748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61815.exe
        7⤵
        
        PID:9640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36677.exe
        7⤵
        
        PID:13504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42622.exe
        7⤵
        
        PID:16504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53129.exe
        6⤵
        
        PID:8236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22577.exe
        6⤵
        
        PID:6884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5842.exe
        6⤵
        
        PID:15480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20929.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40515.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59155.exe
        7⤵
        
        PID:4212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53927.exe
        8⤵
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7762.exe
        9⤵
        
        PID:9344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14913.exe
        9⤵
        
        PID:13336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37137.exe
        9⤵
        
        PID:5220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12261.exe
        8⤵
        
        PID:7724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2490.exe
        9⤵
        
        PID:12592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-298.exe
        9⤵
        
        PID:16968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33396.exe
        8⤵
        
        PID:11812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45830.exe
        8⤵
        
        PID:3556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22520.exe
        8⤵
        
        PID:17336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34532.exe
        7⤵
        
        PID:6780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2142.exe
        8⤵
        
        PID:9172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29905.exe
        8⤵
        
        PID:3996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28480.exe
        8⤵
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7305.exe
        7⤵
        
        PID:7804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57177.exe
        7⤵
        
        PID:12432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58974.exe
        7⤵
        
        PID:16800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47458.exe
        6⤵
        
        PID:116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-642.exe
        7⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43699.exe
        8⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17379.exe
        9⤵
        
        PID:11288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20253.exe
        9⤵
        
        PID:14960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19352.exe
        9⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8025.exe
        9⤵
        
        PID:17384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55894.exe
        8⤵
        
        PID:9484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6448.exe
        8⤵
        
        PID:13072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8741.exe
        8⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42089.exe
        7⤵
        
        PID:7600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13486.exe
        8⤵
        
        PID:10524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49418.exe
        8⤵
        
        PID:14984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36317.exe
        8⤵
        
        PID:16920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9136.exe
        7⤵
        
        PID:10364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14389.exe
        7⤵
        
        PID:14884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39246.exe
        7⤵
        
        PID:8184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56733.exe
        6⤵
        
        PID:6260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2230.exe
        7⤵
        
        PID:7736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35997.exe
        7⤵
        
        PID:11796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52217.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5913.exe
        7⤵
        
        PID:8876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61026.exe
        6⤵
        
        PID:7080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56217.exe
        6⤵
        
        PID:12096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4293.exe
        6⤵
        
        PID:464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15074.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38085.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52583.exe
        6⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31151.exe
        7⤵
        
        PID:6548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22091.exe
        8⤵
        
        PID:9864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23849.exe
        8⤵
        
        PID:14040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35549.exe
        8⤵
        
        PID:7292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58914.exe
        7⤵
        
        PID:4844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5156.exe
        7⤵
        
        PID:6496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33386.exe
        7⤵
        
        PID:6904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35405.exe
        6⤵
        
        PID:6916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61623.exe
        7⤵
        
        PID:9916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23849.exe
        7⤵
        
        PID:13860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37137.exe
        7⤵
        
        PID:5856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56697.exe
        6⤵
        
        PID:8560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15873.exe
        6⤵
        
        PID:12284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37792.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36558.exe
        5⤵
        
        PID:5588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61659.exe
        6⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15546.exe
        7⤵
        
        PID:8188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26973.exe
        7⤵
        
        PID:12808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40733.exe
        7⤵
        
        PID:6512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49401.exe
        6⤵
        
        PID:8672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21484.exe
        6⤵
        
        PID:15296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35201.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64509.exe
        5⤵
        
        PID:7260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25843.exe
        6⤵
        
        PID:13248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27926.exe
        6⤵
        
        PID:16356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62546.exe
        5⤵
        
        PID:9528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4178.exe
        5⤵
        
        PID:13100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44441.exe
        5⤵
        
        PID:17396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18817.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18817.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36711.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30161.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36823.exe
        7⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4482.exe
        8⤵
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22615.exe
        9⤵
        
        PID:11452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40733.exe
        9⤵
        
        PID:820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49401.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21484.exe
        8⤵
        
        PID:15212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54314.exe
        8⤵
        
        PID:15460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52125.exe
        7⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50243.exe
        8⤵
        
        PID:10696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5069.exe
        8⤵
        
        PID:15160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4713.exe
        8⤵
        
        PID:16308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49978.exe
        7⤵
        
        PID:11272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31188.exe
        7⤵
        
        PID:15060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17557.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19016.exe
        6⤵
        
        PID:5336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63299.exe
        7⤵
        
        PID:8104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50243.exe
        8⤵
        
        PID:10612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24337.exe
        8⤵
        
        PID:12468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43857.exe
        8⤵
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23018.exe
        8⤵
        
        PID:9572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17933.exe
        7⤵
        
        PID:11248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49722.exe
        7⤵
        
        PID:456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31840.exe
        7⤵
        
        PID:10136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39838.exe
        6⤵
        
        PID:7924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26128.exe
        6⤵
        
        PID:12020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49217.exe
        6⤵
        
        PID:5848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7866.exe
        6⤵
        
        PID:9616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48278.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49835.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9002.exe
        7⤵
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1706.exe
        8⤵
        
        PID:4024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15053.exe
        8⤵
        
        PID:9308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26868.exe
        8⤵
        
        PID:14260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47911.exe
        8⤵
        
        PID:15688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58129.exe
        7⤵
        
        PID:6248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55598.exe
        7⤵
        
        PID:11784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49417.exe
        7⤵
        
        PID:5396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52254.exe
        7⤵
        
        PID:17484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14304.exe
        6⤵
        
        PID:6188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8530.exe
        7⤵
        
        PID:9740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64882.exe
        7⤵
        
        PID:13748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2824.exe
        7⤵
        
        PID:6812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23210.exe
        7⤵
        
        PID:8860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54970.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28588.exe
        6⤵
        
        PID:10780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58398.exe
        6⤵
        
        PID:15496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15116.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57051.exe
        6⤵
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42547.exe
        7⤵
        
        PID:5136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61623.exe
        8⤵
        
        PID:9792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64882.exe
        8⤵
        
        PID:13764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40702.exe
        8⤵
        
        PID:7108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53626.exe
        7⤵
        
        PID:9144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-444.exe
        7⤵
        
        PID:3316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44211.exe
        7⤵
        
        PID:16752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53574.exe
        6⤵
        
        PID:7268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47119.exe
        7⤵
        
        PID:11524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15076.exe
        7⤵
        
        PID:6900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16344.exe
        6⤵
        
        PID:9700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12313.exe
        6⤵
        
        PID:13496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40917.exe
        6⤵
        
        PID:656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11504.exe
        5⤵
        
        PID:6208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56387.exe
        6⤵
        
        PID:8476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51478.exe
        6⤵
        
        PID:12712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61345.exe
        6⤵
        
        PID:5796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47641.exe
        5⤵
        
        PID:9208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57707.exe
        5⤵
        
        PID:12604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14545.exe
        5⤵
        
        PID:16720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50809.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16011.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26483.exe
        6⤵
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25147.exe
        7⤵
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63159.exe
        8⤵
        
        PID:6196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54227.exe
        9⤵
        
        PID:8388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14285.exe
        8⤵
        
        PID:10124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55265.exe
        8⤵
        
        PID:14220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64870.exe
        8⤵
        
        PID:17276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37045.exe
        7⤵
        
        PID:7304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42371.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53391.exe
        8⤵
        
        PID:16936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16344.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43362.exe
        7⤵
        
        PID:13016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28664.exe
        7⤵
        
        PID:7708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59526.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56387.exe
        7⤵
        
        PID:8496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43309.exe
        7⤵
        
        PID:12832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46706.exe
        7⤵
        
        PID:16516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63330.exe
        6⤵
        
        PID:9064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12252.exe
        6⤵
        
        PID:12324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51190.exe
        6⤵
        
        PID:7712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51542.exe
        5⤵
        
        PID:3400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45354.exe
        6⤵
        
        PID:7640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32615.exe
        7⤵
        
        PID:14288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-729.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57450.exe
        6⤵
        
        PID:11300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37147.exe
        6⤵
        
        PID:14460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13009.exe
        6⤵
        
        PID:6988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11617.exe
        5⤵
        
        PID:6668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6522.exe
        6⤵
        
        PID:10528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43605.exe
        6⤵
        
        PID:15040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65481.exe
        6⤵
        
        PID:15968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64177.exe
        5⤵
        
        PID:7300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40641.exe
        5⤵
        
        PID:12580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42516.exe
        5⤵
        
        PID:7512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40058.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40058.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51947.exe
        5⤵
        
        PID:1752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50995.exe
        6⤵
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27171.exe
        7⤵
        
        PID:7176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64062.exe
        7⤵
        
        PID:9708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26868.exe
        7⤵
        
        PID:12576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43002.exe
        7⤵
        
        PID:5384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1249.exe
        6⤵
        
        PID:7572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51691.exe
        7⤵
        
        PID:12204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31901.exe
        7⤵
        
        PID:16944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9136.exe
        6⤵
        
        PID:10416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14389.exe
        6⤵
        
        PID:14896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33817.exe
        6⤵
        
        PID:6844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42997.exe
        5⤵
        
        PID:6288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26921.exe
        6⤵
        
        PID:9992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40429.exe
        6⤵
        
        PID:14520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6193.exe
        6⤵
        
        PID:16864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63330.exe
        5⤵
        
        PID:9048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12252.exe
        5⤵
        
        PID:12376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23286.exe
        5⤵
        
        PID:16588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43653.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43653.exe
      4⤵
      PID:3596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7414.exe
        5⤵
        
        PID:7032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17275.exe
        6⤵
        
        PID:9316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14913.exe
        6⤵
        
        PID:13324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12113.exe
        6⤵
        
        PID:5372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55214.exe
        5⤵
        
        PID:8708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10008.exe
        5⤵
        
        PID:12216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7070.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15197.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15197.exe
      4⤵
      PID:6536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47363.exe
        5⤵
        
        PID:11032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60518.exe
        5⤵
        
        PID:14448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13073.exe
        5⤵
        
        PID:15912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64707.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64707.exe
      4⤵
      PID:7928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36176.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36176.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36345.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36345.exe
      4⤵
      PID:15600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-177.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-177.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34407.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34407.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11822.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22953.exe
        6⤵
        
        PID:1928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21255.exe
        7⤵
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50834.exe
        8⤵
        
        PID:8124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39247.exe
        9⤵
        
        PID:13052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26997.exe
        9⤵
        
        PID:3708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34218.exe
        8⤵
        
        PID:11608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23980.exe
        8⤵
        
        PID:14988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49986.exe
        8⤵
        
        PID:2192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49298.exe
        7⤵
        
        PID:7336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21655.exe
        8⤵
        
        PID:11172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53118.exe
        8⤵
        
        PID:14824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4028.exe
        8⤵
        
        PID:15504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16344.exe
        7⤵
        
        PID:9736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12313.exe
        7⤵
        
        PID:12932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35545.exe
        7⤵
        
        PID:16772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12000.exe
        6⤵
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15110.exe
        7⤵
        
        PID:7148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31167.exe
        8⤵
        
        PID:11912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26229.exe
        8⤵
        
        PID:3728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25704.exe
        8⤵
        
        PID:9136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59978.exe
        7⤵
        
        PID:9440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6448.exe
        7⤵
        
        PID:4864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18746.exe
        7⤵
        
        PID:16260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39926.exe
        6⤵
        
        PID:7528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24831.exe
        7⤵
        
        PID:13120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56790.exe
        7⤵
        
        PID:15928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57642.exe
        6⤵
        
        PID:9524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56799.exe
        6⤵
        
        PID:15036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42173.exe
        6⤵
        
        PID:15880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61298.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53993.exe
        6⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18007.exe
        7⤵
        
        PID:9828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64882.exe
        7⤵
        
        PID:13780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9181.exe
        7⤵
        
        PID:15592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18789.exe
        6⤵
        
        PID:8864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18825.exe
        6⤵
        
        PID:13376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62827.exe
        6⤵
        
        PID:16284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14548.exe
        5⤵
        
        PID:5452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54607.exe
        6⤵
        
        PID:5404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56387.exe
        7⤵
        
        PID:8404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34203.exe
        8⤵
        
        PID:13032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52514.exe
        8⤵
        
        PID:16444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35333.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51502.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45266.exe
        6⤵
        
        PID:9092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49645.exe
        6⤵
        
        PID:12336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63614.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3361.exe
        5⤵
        
        PID:7328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26175.exe
        6⤵
        
        PID:9928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23849.exe
        6⤵
        
        PID:13844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37578.exe
        6⤵
        
        PID:16348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13544.exe
        5⤵
        
        PID:9628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52650.exe
        5⤵
        
        PID:14164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16278.exe
        5⤵
        
        PID:16524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41157.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41157.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33307.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11477.exe
        6⤵
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22091.exe
        7⤵
        
        PID:9904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23849.exe
        7⤵
        
        PID:13836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52025.exe
        7⤵
        
        PID:2516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47522.exe
        7⤵
        
        PID:9352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64481.exe
        6⤵
        
        PID:4452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15105.exe
        6⤵
        
        PID:11556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45333.exe
        6⤵
        
        PID:5696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23665.exe
        6⤵
        
        PID:6448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21617.exe
        5⤵
        
        PID:5172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9993.exe
        6⤵
        
        PID:8032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54550.exe
        7⤵
        
        PID:13244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-328.exe
        7⤵
        
        PID:16884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10096.exe
        6⤵
        
        PID:10580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63206.exe
        6⤵
        
        PID:14976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1913.exe
        6⤵
        
        PID:16272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55825.exe
        5⤵
        
        PID:7616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28352.exe
        6⤵
        
        PID:11616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37932.exe
        6⤵
        
        PID:6444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15001.exe
        5⤵
        
        PID:10436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5724.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51190.exe
        5⤵
        
        PID:15780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59849.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33123.exe
        5⤵
        
        PID:5320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14430.exe
        6⤵
        
        PID:6864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34239.exe
        7⤵
        
        PID:8612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20777.exe
        7⤵
        
        PID:10744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4905.exe
        7⤵
        
        PID:15884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42961.exe
        6⤵
        
        PID:8596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10008.exe
        6⤵
        
        PID:12224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63614.exe
        6⤵
        
        PID:7016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36173.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21795.exe
        6⤵
        
        PID:8684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61810.exe
        6⤵
        
        PID:12192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34645.exe
        6⤵
        
        PID:16956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12924.exe
        5⤵
        
        PID:8840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58250.exe
        5⤵
        
        PID:12104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39822.exe
        5⤵
        
        PID:16480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24882.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24882.exe
      4⤵
      PID:5328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17711.exe
        5⤵
        
        PID:8812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28945.exe
        5⤵
        
        PID:11280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13841.exe
        5⤵
        
        PID:16788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35256.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35256.exe
      4⤵
      PID:7824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9593.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9593.exe
      4⤵
      PID:11984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21166.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21166.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56916.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56916.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:17900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60949.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60949.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41563.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41563.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12694.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28463.exe
        6⤵
        
        PID:5664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52059.exe
        7⤵
        
        PID:6724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43895.exe
        8⤵
        
        PID:9756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60641.exe
        7⤵
        
        PID:10576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35962.exe
        7⤵
        
        PID:13732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43906.exe
        7⤵
        
        PID:16552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10953.exe
        6⤵
        
        PID:7484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18635.exe
        7⤵
        
        PID:13164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64190.exe
        7⤵
        
        PID:8172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44113.exe
        6⤵
        
        PID:10728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3097.exe
        6⤵
        
        PID:14812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42017.exe
        6⤵
        
        PID:6388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53993.exe
        5⤵
        
        PID:5596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14669.exe
        6⤵
        
        PID:10264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40429.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6193.exe
        6⤵
        
        PID:16872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18789.exe
        5⤵
        
        PID:8852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49585.exe
        5⤵
        
        PID:12120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58974.exe
        5⤵
        
        PID:16820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41541.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41541.exe
      4⤵
      PID:2480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45354.exe
        5⤵
        
        PID:7648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6336.exe
        5⤵
        
        PID:10396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54726.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12614.exe
        5⤵
        
        PID:5832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35536.exe
        5⤵
        
        PID:9396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62598.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62598.exe
      4⤵
      PID:6268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32821.exe
        5⤵
        
        PID:8588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38095.exe
        6⤵
        
        PID:13276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24226.exe
        6⤵
        
        PID:7104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61705.exe
        5⤵
        
        PID:3952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48487.exe
        5⤵
        
        PID:16492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52361.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52361.exe
      4⤵
      PID:5772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39681.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39681.exe
      4⤵
      PID:12084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-746.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-746.exe
      4⤵
      PID:5808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19008.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19008.exe
      4⤵
      PID:10336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24770.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24770.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4718.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4718.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24187.exe
        5⤵
        
        PID:3628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58587.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52687.exe
        7⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47970.exe
        7⤵
        
        PID:12984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13156.exe
        7⤵
        
        PID:16372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50746.exe
        6⤵
        
        PID:8156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9240.exe
        6⤵
        
        PID:10872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29494.exe
        6⤵
        
        PID:4768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34388.exe
        6⤵
        
        PID:7448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39681.exe
        5⤵
        
        PID:6740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61623.exe
        6⤵
        
        PID:9960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23849.exe
        6⤵
        
        PID:13828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44786.exe
        6⤵
        
        PID:7864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39594.exe
        5⤵
        
        PID:8520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62413.exe
        5⤵
        
        PID:12720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22710.exe
        5⤵
        
        PID:8060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-813.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-813.exe
      4⤵
      PID:5488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4482.exe
        5⤵
        
        PID:6056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36351.exe
        6⤵
        
        PID:9160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2853.exe
        6⤵
        
        PID:13156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19160.exe
        6⤵
        
        PID:6332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16001.exe
        6⤵
        
        PID:9656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45317.exe
        5⤵
        
        PID:9392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63206.exe
        5⤵
        
        PID:15012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9588.exe
        5⤵
        
        PID:7844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49821.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49821.exe
      4⤵
      PID:5780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1234.exe
        5⤵
        
        PID:10708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53118.exe
        5⤵
        
        PID:14916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46706.exe
        5⤵
        
        PID:16564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14041.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14041.exe
      4⤵
      PID:9548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3648.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3648.exe
      4⤵
      PID:13944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24381.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24381.exe
      4⤵
      PID:5660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16208.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16208.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24571.exe
      4⤵
      PID:5616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62583.exe
        5⤵
        
        PID:6384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18007.exe
        6⤵
        
        PID:9836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64882.exe
        6⤵
        
        PID:13788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32616.exe
        6⤵
        
        PID:15760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-149.exe
        5⤵
        
        PID:7952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8229.exe
        5⤵
        
        PID:14284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2188.exe
        5⤵
        
        PID:15652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45022.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45022.exe
      4⤵
      PID:7420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57185.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57185.exe
      4⤵
      PID:9968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13621.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13621.exe
      4⤵
      PID:14388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43330.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43330.exe
      4⤵
      PID:7968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58202.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58202.exe
    3⤵
    PID:5944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52687.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52687.exe
      4⤵
      PID:9188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39121.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39121.exe
      4⤵
      PID:12948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42566.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42566.exe
      4⤵
      PID:15896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43763.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43763.exe
    3⤵
    PID:8116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5128.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5128.exe
    3⤵
    PID:11956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22889.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22889.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54821.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54821.exe
    3⤵
    PID:17440
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62102.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62102.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:32
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61075.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61075.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1542.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1542.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12782.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8610.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8042.exe
        7⤵
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42739.exe
        8⤵
        
        PID:6404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50347.exe
        9⤵
        
        PID:13236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39929.exe
        9⤵
        
        PID:17148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13796.exe
        8⤵
        
        PID:10932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14581.exe
        8⤵
        
        PID:14372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34969.exe
        8⤵
        
        PID:15680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32577.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13486.exe
        8⤵
        
        PID:8920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16361.exe
        8⤵
        
        PID:14352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45061.exe
        8⤵
        
        PID:7808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9136.exe
        7⤵
        
        PID:10424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14389.exe
        7⤵
        
        PID:14872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10081.exe
        7⤵
        
        PID:16320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63802.exe
        6⤵
        
        PID:5968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14688.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50679.exe
        7⤵
        
        PID:9944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23849.exe
        7⤵
        
        PID:14024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14033.exe
        7⤵
        
        PID:5872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61166.exe
        6⤵
        
        PID:9032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5812.exe
        6⤵
        
        PID:12300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16981.exe
        6⤵
        
        PID:16232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25501.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56475.exe
        6⤵
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3330.exe
        7⤵
        
        PID:6996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35089.exe
        8⤵
        
        PID:9988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40429.exe
        8⤵
        
        PID:14556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49722.exe
        8⤵
        
        PID:5748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44285.exe
        8⤵
        
        PID:9608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34793.exe
        7⤵
        
        PID:8544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34704.exe
        7⤵
        
        PID:12168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5617.exe
        7⤵
        
        PID:15920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65146.exe
        6⤵
        
        PID:7128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11462.exe
        7⤵
        
        PID:8412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26973.exe
        7⤵
        
        PID:12696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45637.exe
        7⤵
        
        PID:8340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11580.exe
        6⤵
        
        PID:8792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48546.exe
        6⤵
        
        PID:6284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24720.exe
        6⤵
        
        PID:6876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32025.exe
        6⤵
        
        PID:10196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30692.exe
        5⤵
        
        PID:5576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60891.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21655.exe
        7⤵
        
        PID:11204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53118.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46130.exe
        7⤵
        
        PID:15528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45650.exe
        6⤵
        
        PID:8636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31964.exe
        6⤵
        
        PID:13112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38482.exe
        6⤵
        
        PID:15656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42474.exe
        5⤵
        
        PID:5984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24831.exe
        6⤵
        
        PID:14216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23842.exe
        6⤵
        
        PID:16076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25220.exe
        5⤵
        
        PID:10108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35929.exe
        5⤵
        
        PID:14192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30923.exe
        5⤵
        
        PID:16744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42117.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42117.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58003.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18493.exe
        6⤵
        
        PID:6200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33611.exe
        7⤵
        
        PID:9260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52452.exe
        8⤵
        
        PID:17264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64114.exe
        7⤵
        
        PID:13104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5289.exe
        7⤵
        
        PID:1924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55161.exe
        6⤵
        
        PID:1520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25656.exe
        6⤵
        
        PID:12820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58079.exe
        6⤵
        
        PID:17180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16957.exe
        5⤵
        
        PID:5564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32303.exe
        6⤵
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61623.exe
        7⤵
        
        PID:9972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23849.exe
        7⤵
        
        PID:13880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35881.exe
        7⤵
        
        PID:5392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40698.exe
        7⤵
        
        PID:10324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53242.exe
        6⤵
        
        PID:7956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58503.exe
        7⤵
        
        PID:17200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59977.exe
        6⤵
        
        PID:12448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15046.exe
        6⤵
        
        PID:15552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48861.exe
        5⤵
        
        PID:5980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42947.exe
        6⤵
        
        PID:1472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16873.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46138.exe
        5⤵
        
        PID:10000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52465.exe
        5⤵
        
        PID:14168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50230.exe
        5⤵
        
        PID:15640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2480.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2480.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8234.exe
        5⤵
        
        PID:5516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45323.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18007.exe
        7⤵
        
        PID:9888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23849.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8112.exe
        7⤵
        
        PID:15488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49401.exe
        6⤵
        
        PID:8652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64830.exe
        6⤵
        
        PID:13660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33516.exe
        6⤵
        
        PID:16208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15473.exe
        5⤵
        
        PID:7192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16344.exe
        5⤵
        
        PID:9652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54654.exe
        5⤵
        
        PID:13196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39246.exe
        5⤵
        
        PID:8068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17865.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48411.exe
        5⤵
        
        PID:7200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63922.exe
        5⤵
        
        PID:12508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32616.exe
        5⤵
        
        PID:15668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43233.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43233.exe
      4⤵
      PID:8132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9593.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9593.exe
      4⤵
      PID:11992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37503.exe
      4⤵
      PID:7076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32412.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32412.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:17864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47214.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47214.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49731.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49731.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64827.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22783.exe
        6⤵
        
        PID:3340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58587.exe
        7⤵
        
        PID:6472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12806.exe
        8⤵
        
        PID:9600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36677.exe
        8⤵
        
        PID:13512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1013.exe
        8⤵
        
        PID:6976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50746.exe
        7⤵
        
        PID:920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5156.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8881.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64705.exe
        7⤵
        
        PID:10216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6817.exe
        6⤵
        
        PID:6852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2438.exe
        7⤵
        
        PID:8480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34129.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12388.exe
        7⤵
        
        PID:7236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31424.exe
        6⤵
        
        PID:8256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11021.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49417.exe
        6⤵
        
        PID:392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15497.exe
        6⤵
        
        PID:8896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57693.exe
        5⤵
        
        PID:6656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12505.exe
        6⤵
        
        PID:10884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41581.exe
        6⤵
        
        PID:14420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43443.exe
        6⤵
        
        PID:7704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61986.exe
        5⤵
        
        PID:3020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2356.exe
        5⤵
        
        PID:11520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24521.exe
        5⤵
        
        PID:1080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65235.exe
        5⤵
        
        PID:10164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12097.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12097.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52583.exe
        5⤵
        
        PID:5160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51379.exe
        6⤵
        
        PID:6716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40435.exe
        7⤵
        
        PID:8808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31441.exe
        7⤵
        
        PID:13024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2824.exe
        7⤵
        
        PID:4936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61118.exe
        7⤵
        
        PID:10288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17881.exe
        6⤵
        
        PID:7460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5156.exe
        6⤵
        
        PID:11460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37662.exe
        6⤵
        
        PID:6136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15504.exe
        6⤵
        
        PID:17452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65146.exe
        5⤵
        
        PID:7120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21655.exe
        6⤵
        
        PID:11212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20637.exe
        6⤵
        
        PID:15116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4988.exe
        6⤵
        
        PID:7904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19748.exe
        5⤵
        
        PID:8736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15873.exe
        5⤵
        
        PID:12200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57393.exe
        5⤵
        
        PID:7084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46837.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46837.exe
      4⤵
      PID:5756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42931.exe
        5⤵
        
        PID:4272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58707.exe
        6⤵
        
        PID:13056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60983.exe
        6⤵
        
        PID:15436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13361.exe
        5⤵
        
        PID:9516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1212.exe
        5⤵
        
        PID:13456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49582.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44970.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44970.exe
      4⤵
      PID:7796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30119.exe
        5⤵
        
        PID:13228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60983.exe
        5⤵
        
        PID:15444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42901.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42901.exe
      4⤵
      PID:10492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38005.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38005.exe
      4⤵
      PID:14952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31115.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31115.exe
      4⤵
      PID:16576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51769.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51769.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53919.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53919.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34532.exe
        5⤵
        
        PID:6596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40325.exe
        6⤵
        
        PID:10476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57341.exe
        6⤵
        
        PID:15088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51502.exe
        6⤵
        
        PID:8420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50109.exe
        5⤵
        
        PID:9804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59282.exe
        5⤵
        
        PID:13740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64472.exe
        5⤵
        
        PID:17240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53906.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53906.exe
      4⤵
      PID:5524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62583.exe
        5⤵
        
        PID:3816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36739.exe
        6⤵
        
        PID:16916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-149.exe
        5⤵
        
        PID:7988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21759.exe
        6⤵
        
        PID:13212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52623.exe
        6⤵
        
        PID:15944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61705.exe
        5⤵
        
        PID:12924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13785.exe
        5⤵
        
        PID:15852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38337.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38337.exe
      4⤵
      PID:7440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1530.exe
        5⤵
        
        PID:12956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23842.exe
        5⤵
        
        PID:16332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63050.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63050.exe
      4⤵
      PID:9768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4956.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4956.exe
      4⤵
      PID:14376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39669.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39669.exe
      4⤵
      PID:17204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45294.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45294.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20679.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20679.exe
      4⤵
      PID:5408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4482.exe
        5⤵
        
        PID:6072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-746.exe
        6⤵
        
        PID:9380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28509.exe
        6⤵
        
        PID:13404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33877.exe
        6⤵
        
        PID:7412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49401.exe
        5⤵
        
        PID:8728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64830.exe
        5⤵
        
        PID:12676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38945.exe
        5⤵
        
        PID:6948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36085.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36085.exe
      4⤵
      PID:7136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5422.exe
        5⤵
        
        PID:13004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57091.exe
        5⤵
        
        PID:1132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8176.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8176.exe
      4⤵
      PID:9460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12313.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12313.exe
      4⤵
      PID:10488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2188.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2188.exe
      4⤵
      PID:8436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40721.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40721.exe
    3⤵
    PID:5428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17083.exe
      4⤵
      PID:9452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40761.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40761.exe
      4⤵
      PID:13480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38970.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38970.exe
      4⤵
      PID:8552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43225.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43225.exe
    3⤵
    PID:7940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26659.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26659.exe
    3⤵
    PID:11976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11888.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11888.exe
    3⤵
    PID:6420
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63113.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63113.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42383.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42383.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45839.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45839.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59473.exe
        5⤵
        
        PID:5464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11410.exe
        6⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43523.exe
        7⤵
        
        PID:12320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27625.exe
        7⤵
        
        PID:17228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34218.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23980.exe
        6⤵
        
        PID:14992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25289.exe
        6⤵
        
        PID:6936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52370.exe
        5⤵
        
        PID:7472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25931.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41249.exe
        6⤵
        
        PID:15316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41662.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58469.exe
        5⤵
        
        PID:9856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21093.exe
        5⤵
        
        PID:14548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2718.exe
        5⤵
        
        PID:8064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36793.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36793.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37953.exe
        5⤵
        
        PID:5472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51867.exe
        6⤵
        
        PID:1372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53663.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60983.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64062.exe
        6⤵
        
        PID:9728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7756.exe
        6⤵
        
        PID:14424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44211.exe
        6⤵
        
        PID:16732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34060.exe
        5⤵
        
        PID:7520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50347.exe
        6⤵
        
        PID:13256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65259.exe
        6⤵
        
        PID:8228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16808.exe
        5⤵
        
        PID:10388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43817.exe
        5⤵
        
        PID:15320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38432.exe
        5⤵
        
        PID:7764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55581.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55581.exe
      4⤵
      PID:5356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44363.exe
        5⤵
        
        PID:6980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61623.exe
        6⤵
        
        PID:9980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23849.exe
        6⤵
        
        PID:13852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33685.exe
        6⤵
        
        PID:15516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42961.exe
        5⤵
        
        PID:8580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10008.exe
        5⤵
        
        PID:12184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11730.exe
        5⤵
        
        PID:8204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15125.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15125.exe
      4⤵
      PID:7156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44327.exe
        5⤵
        
        PID:8000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31271.exe
        6⤵
        
        PID:12692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23842.exe
        6⤵
        
        PID:8304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63922.exe
        5⤵
        
        PID:12516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32616.exe
        5⤵
        
        PID:15860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16948.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16948.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56210.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56210.exe
      4⤵
      PID:12236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1514.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1514.exe
      4⤵
      PID:7012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62730.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62730.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56851.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56851.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15190.exe
        5⤵
        
        PID:3432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33433.exe
        6⤵
        
        PID:6148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20975.exe
        7⤵
        
        PID:9540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53014.exe
        7⤵
        
        PID:13464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13156.exe
        7⤵
        
        PID:2772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45021.exe
        6⤵
        
        PID:9120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37254.exe
        6⤵
        
        PID:2972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41986.exe
        6⤵
        
        PID:7404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42997.exe
        5⤵
        
        PID:6296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60938.exe
        6⤵
        
        PID:10372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8524.exe
        6⤵
        
        PID:14828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16909.exe
        6⤵
        
        PID:5556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63330.exe
        5⤵
        
        PID:9056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12252.exe
        5⤵
        
        PID:12348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54506.exe
        5⤵
        
        PID:7852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36609.exe
      4⤵
      PID:5208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51571.exe
        5⤵
        
        PID:6684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46211.exe
        6⤵
        
        PID:10176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16833.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1013.exe
        6⤵
        
        PID:7556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42385.exe
        5⤵
        
        PID:7964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5156.exe
        5⤵
        
        PID:11180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45830.exe
        5⤵
        
        PID:5196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64897.exe
        5⤵
        
        PID:9660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25788.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25788.exe
      4⤵
      PID:7064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44327.exe
        5⤵
        
        PID:7172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63922.exe
        5⤵
        
        PID:12524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8029.exe
        5⤵
        
        PID:1436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25614.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25614.exe
      4⤵
      PID:8768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39881.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39881.exe
      4⤵
      PID:11244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51190.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51190.exe
      4⤵
      PID:15964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9496.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9496.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40523.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40523.exe
      4⤵
      PID:252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62863.exe
        5⤵
        
        PID:6276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34239.exe
        6⤵
        
        PID:8624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20777.exe
        6⤵
        
        PID:10760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59005.exe
        6⤵
        
        PID:17216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41425.exe
        5⤵
        
        PID:4556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59017.exe
        5⤵
        
        PID:12156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57890.exe
        5⤵
        
        PID:6436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31897.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61623.exe
        5⤵
        
        PID:9816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64882.exe
        5⤵
        
        PID:13756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2824.exe
        5⤵
        
        PID:6640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47522.exe
        5⤵
        
        PID:9360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64481.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64481.exe
      4⤵
      PID:3268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13590.exe
        5⤵
        
        PID:13092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52322.exe
        5⤵
        
        PID:16812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35718.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35718.exe
      4⤵
      PID:10788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37164.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37164.exe
      4⤵
      PID:3620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48361.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48361.exe
      4⤵
      PID:9584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20413.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20413.exe
    3⤵
    PID:5420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21395.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21395.exe
      4⤵
      PID:4376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46211.exe
        5⤵
        
        PID:10188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16833.exe
        5⤵
        
        PID:14276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43665.exe
        5⤵
        
        PID:4980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33397.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33397.exe
      4⤵
      PID:8556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27882.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27882.exe
      4⤵
      PID:12976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64326.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64326.exe
      4⤵
      PID:15836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33808.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33808.exe
    3⤵
    PID:7152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54550.exe
      4⤵
      PID:13204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-821.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-821.exe
      4⤵
      PID:15956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8685.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8685.exe
    3⤵
    PID:10116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52995.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52995.exe
    3⤵
    PID:14208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50424.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50424.exe
    3⤵
    PID:16624
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50286.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50286.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37479.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37479.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45367.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45367.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56475.exe
        5⤵
        
        PID:5232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36003.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22091.exe
        7⤵
        
        PID:9952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23849.exe
        7⤵
        
        PID:14016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12388.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63382.exe
        6⤵
        
        PID:8760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42681.exe
        6⤵
        
        PID:10768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50490.exe
        6⤵
        
        PID:6432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20797.exe
        5⤵
        
        PID:6692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61623.exe
        6⤵
        
        PID:9784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64882.exe
        6⤵
        
        PID:13772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8112.exe
        6⤵
        
        PID:15540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1440.exe
        5⤵
        
        PID:4088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-305.exe
        5⤵
        
        PID:12596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6381.exe
        5⤵
        
        PID:15616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46314.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46314.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48167.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50243.exe
        6⤵
        
        PID:11044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20253.exe
        6⤵
        
        PID:15188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52025.exe
        6⤵
        
        PID:4912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34218.exe
        5⤵
        
        PID:11588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25481.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48425.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15961.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15961.exe
      4⤵
      PID:10588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54541.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54541.exe
      4⤵
      PID:14964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7874.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7874.exe
      4⤵
      PID:8384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9165.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9165.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-66.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-66.exe
      4⤵
      PID:5508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49599.exe
        5⤵
        
        PID:6972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37119.exe
        6⤵
        
        PID:9140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32977.exe
        6⤵
        
        PID:13084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35549.exe
        6⤵
        
        PID:6932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41565.exe
        5⤵
        
        PID:8784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40399.exe
        6⤵
        
        PID:12972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60983.exe
        6⤵
        
        PID:15576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5148.exe
        5⤵
        
        PID:15284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59358.exe
        5⤵
        
        PID:15564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19749.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19749.exe
      4⤵
      PID:5340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12260.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12260.exe
      4⤵
      PID:9680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12313.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12313.exe
      4⤵
      PID:13396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32748.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35353.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35353.exe
    3⤵
    PID:5124
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5124 -s 632
      4⤵
      Program crash
      PID:7580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61690.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61690.exe
    3⤵
    PID:7608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53558.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53558.exe
    3⤵
    PID:10356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60883.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60883.exe
    3⤵
    PID:14880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14545.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14545.exe
    3⤵
    PID:16760
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16104.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16104.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4526.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4526.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-66.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-66.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50834.exe
        5⤵
        
        PID:7344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30324.exe
        5⤵
        
        PID:10844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63206.exe
        5⤵
        
        PID:14996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39822.exe
        5⤵
        
        PID:16608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29645.exe
      4⤵
      PID:7728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33435.exe
        5⤵
        
        PID:12404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28310.exe
        5⤵
        
        PID:8072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9136.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9136.exe
      4⤵
      PID:10408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14389.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14389.exe
      4⤵
      PID:14864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32653.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32653.exe
      4⤵
      PID:17356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5281.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5281.exe
    3⤵
    PID:5344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11026.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11026.exe
      4⤵
      PID:2920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59978.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59978.exe
      4⤵
      PID:9496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6448.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6448.exe
      4⤵
      PID:12844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42182.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42182.exe
      4⤵
      PID:16220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15368.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15368.exe
    3⤵
    PID:6096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17217.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17217.exe
      4⤵
      PID:12112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4604.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4604.exe
      4⤵
      PID:16544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23746.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23746.exe
    3⤵
    PID:10860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56461.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56461.exe
    3⤵
    PID:14660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14542.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14542.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7896
- C:\Users\Admin\AppData\Local\Temp\Unicorn-65018.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-65018.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8042.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8042.exe
    3⤵
    PID:5640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4482.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4482.exe
      4⤵
      PID:6908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59319.exe
        5⤵
        
        PID:9192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50326.exe
        5⤵
        
        PID:12368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40785.exe
        5⤵
        
        PID:15932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45317.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45317.exe
      4⤵
      PID:8248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63206.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63206.exe
      4⤵
      PID:15004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43714.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43714.exe
      4⤵
      PID:16996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64377.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64377.exe
    3⤵
    PID:5180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19661.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19661.exe
    3⤵
    PID:10832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34696.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34696.exe
    3⤵
    PID:13420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25725.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25725.exe
    3⤵
    PID:7592
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9730.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9730.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38581.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38581.exe
    3⤵
    PID:8108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20164.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20164.exe
      4⤵
      PID:15796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38493.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38493.exe
    3⤵
    PID:10912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14581.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14581.exe
    3⤵
    PID:14364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24.exe
    3⤵
    PID:6768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21169.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21169.exe
    3⤵
    PID:8232
- C:\Users\Admin\AppData\Local\Temp\Unicorn-43892.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-43892.exe
  2⤵
  PID:7816
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61682.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61682.exe
  2⤵
  PID:10512
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32405.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32405.exe
  2⤵
  PID:15064
- C:\Users\Admin\AppData\Local\Temp\Unicorn-2934.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-2934.exe
  2⤵
  PID:16860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5124 -ip 5124
1⤵
PID:7888

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10234.exe

Filesize
468KB

MD5
dae4bbb93227193c70b349a88fc2ebf3

SHA1
50374ee0b3fed87b99a4a05b950f649e4314bdfa

SHA256
3d451497de8bae397beedac7400f7e5d2d727bd8aae09980453f2052d88d5cbd

SHA512
4503b6655317724fbeb1d9c65b6a931d181711906722acbc7c26d2c6d8a4741e8988c29a7933c7f4f29788963b12c2ced360d294540d2be239596b73acd1325e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11822.exe

Filesize
468KB

MD5
31bf6355471e729743fe80731d9b257b

SHA1
1058ded4374fae2cd93af99445252ebc6cd3def7

SHA256
cdcc75d7483d8e767aea6804d157856e91d87b93e79eb3102ba911f19958d174

SHA512
751e5a8eca647c50e28a604692f26310c6507ffb3f445bd9290bc5bf1ccd9bfd9ecc35f66f6f33eabddd0a75e5bfaad420b51a3e751a2621792084fad4a4cd56

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12782.exe

Filesize
468KB

MD5
31f847bec96818b8e04266f8b66a6b00

SHA1
35f7f2779bf0e26bb223191e7b02a9d7a32e9240

SHA256
edc608038b830b5d3d56e511e948b6542493acf7c8e485be91f5d8183e34afe8

SHA512
da62e92bacc34cf1cc36347139e9ba2de028758aa7154edb0f4fa898d164b1550ee80ca8f32788085c3e03c02aa1d47ab8affd5419529e3c8e732e0708111361

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1542.exe

Filesize
468KB

MD5
c9f945f85f5ed34a54dbb7ec1c193c71

SHA1
576bb7d030001efe78fbd8f2b813c035aaa6a2ba

SHA256
9356a94a6cb434ebf77f74c4288ab905f4cf977b82dac57795a70f80f594dc11

SHA512
7fc3e34a33d08a9d51a4330aedfbbe18bd5b35627ddb8abebcaa75762401b3b010ba044c67d75bdd4738ba826d1e253fd08e50882f76554fb46acded3cf3eb44

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16104.exe

Filesize
468KB

MD5
8a8627479ece1c4a8ad173d0c9560347

SHA1
a47dafbb3b6ad649a53b8c1ae9deaa2730f49f1d

SHA256
5ab5e702f1c73a9577676d4b07168a6a27b6a9ba9cc33cf3c1c795a06ae07c65

SHA512
ccb1acc919dd4d422450f210510c0e22c272fbdb2bbd7129f1e1404581598d05d155808e6da3e754fde37ad90232690ba975de6b0aa57a9a7691cf19eee303a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-177.exe

Filesize
468KB

MD5
4617f8666349a995f50c05c5df1d6482

SHA1
35e928d5428a192d74c9e18be07f54b863dfea44

SHA256
9dab9cc121ab72c01ac9a93304b91271ab7e2b59733a87f20755b47adf186c7a

SHA512
dd4a63387918a559baeb902daedf32ce6af5ce9863bd216c60b32201b7e45d74fced6fb35001bd57123c931fb0875d6ab01ee5e7aa8ed183177dd04774fc262b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18817.exe

Filesize
468KB

MD5
3dcf4e631a551f56db16d7fbf1512c26

SHA1
d32ddcc0d8a1df6bb850001b15a365db6072e471

SHA256
e009270476b990898abc28cc3cc4771903d7a65590789cebeff063fcca3bf83a

SHA512
5650104137ba7f84193680a0c05a90aca30d56460a82e487d36f1eb99c440aa0b4a4cd72a082e5fabb99b39e1c63b0f9940b91e03d2e2d1b2080c14915e3a818

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20929.exe

Filesize
468KB

MD5
c9a8c209b4d631cf231f7309bd945532

SHA1
12819a2b750f09e6c89f6ec2a5b1b391920895c2

SHA256
7e5a1df9e8291b0e7cd51c0b2646be2581e6b32f4ab0155bc81587c5f8a4fa18

SHA512
708cc7892ca775ce39caef82fff8c87bdd89fa048c53ec2306f9016e84f3c611b65d58d7af985186321d4276cf54dd03c00d1c418fdecf223bf93c04c9c838bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24770.exe

Filesize
468KB

MD5
4a66073ac33794a61cec03e0e3a7f514

SHA1
d4a6b2a1385eccd2363e35f257fc61b8eacf7e13

SHA256
30a077c4ecf298b0591adb155735010af3bb6b2214954f470f088a0e93c08fa5

SHA512
5f7bd5d6920ca44e26973b4853f10150a0a57b3509316d0dc8e250409fbdabed1058800d25cc2bd0694120f9c136a4321670a83b13ec50ac1c47fa2827c39e66

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34407.exe

Filesize
468KB

MD5
c947174a9a77879e91484ab7b3b389d6

SHA1
151048d3359847b3a6c47fd686708e07f4d609ff

SHA256
16380eb18b8ae85f18b26b6e81d8eda21a6a6848e5ed9131d28fbe135d431491

SHA512
9cd19e1615d89322f562101657ac98417a4b7c38656b5120c66d7f0d475b46e03d9ffbc27cd8184579f0e1b89da021eaa7a28e1455cbd5e8915a550529438fc0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36711.exe

Filesize
468KB

MD5
7c70a3d41d47f07af7d8d50d3ce9befb

SHA1
08fcd0509a9d3300df8325ece98b5b0b49771e02

SHA256
ed6ca533bbc8aa95ce751e2427ec4cea18ef99e9a2ff967210926f56e439b643

SHA512
72127971141b8adb062949619c2c1e4723584f4de8da02093a256ae64e379a941cd91378a43bdb27856936c2519ccae019180a2c05ac46c4392d007c614e195d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37119.exe

Filesize
468KB

MD5
9434ebf26731448b623ec9e2a78f890f

SHA1
1604d6756bbd68d7132c5b1b59103bb6f682c246

SHA256
116a25b7f2e7fe1df40c840d8acf62cc32654f5c27d4327aa95c775392f54177

SHA512
b3116ca191ae158058faeb58b47d578cf7a8a4034e13fe8ee676b1a550e55bbbd70c265a8fba840429f3e5f95cdd595df150f09af51805f8318266b70517d039

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37479.exe

Filesize
468KB

MD5
296c03d025f414960939b8d730c5a16b

SHA1
bcc5371601482e0176e7a0f675be608cce3e4870

SHA256
1406dc870cf9c947620bc6e11eddee04cb6e4d46285f53c9ae2e17a95689306a

SHA512
fd3b5f87be57dd69e3a0094e1769e1d3491634b24c13e565e28774acbe1ea3b1c650ea46a23f58eef1100719db4f31c448bdd57f40085ccef33a3f571a2a5001

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41157.exe

Filesize
468KB

MD5
148fb4dc1f3dec4e7eda2fc6a9c9e759

SHA1
a2f3246e57394d37cba5c3f8d35f78d97bc7fe4a

SHA256
18b491d681f63c5c866109593ab3001696cb3f02166168c6edf155f46b6c5de3

SHA512
f3d3375a9db0e760b4a9267b1d14a95c5e4a4669e317c1d0f9a8c112faebd80a9b58006cdd554c413e9dca3a5b659fe128a0c3678a12c316901ce57d8a564401

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41563.exe

Filesize
468KB

MD5
9052105f2f3d62693226237b4f7671f2

SHA1
5d526f34b69de4c610315409d144dd1fc4768381

SHA256
8182b41c033c9b7c2961c8363d43dd34b6d016109e974eb4722385bee8bd005f

SHA512
e6949e9385d7638be405c0935a34d4c20ed070ca84442a2d727262c48a0529689c5ef06c55f1baf18b94c6b9674e9d745c1e9a519d0c2293c7f76bc095604ba9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42117.exe

Filesize
468KB

MD5
3230268f382d273f3b5a6b84e8d82810

SHA1
37dfb8e851eb2d6ecf68bc3151efe36c1fe86d0d

SHA256
27d8bcddd8f2d5086794d13dbb619df77b54771d6e2b92a5f8ab9b62cda87546

SHA512
304f8dc045bc57103b7dcc461b7dc8bac96062230f9a089a0610da44e58d7807d071c7c59469c29f7998f6b6ef0c831b86ffb33f57e386b6550c0568921f5d4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42383.exe

Filesize
468KB

MD5
ef0789bb3e006f4ff48c347fcb8297db

SHA1
9c9f8d51866888ee832581042553de08f6196ee0

SHA256
4709cde8dcd607fac984c027a994371472e0ef805f71fda77337f355ae11acce

SHA512
3846ef088a1a7140b0412f8e4a2c20a0f411c05ba7fd928c36f0da1a24ce98acb131d141cb91d81ca1c0336339fa654ec4db4412a6b5ffd6e98361b55eb5d6a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42767.exe

Filesize
468KB

MD5
d9860d81f095d7fb426207887e90f518

SHA1
3108948b7c0c99816919f4c5688e73fdeee35d5c

SHA256
868bbf58ebec716737cb845ce7b2ad1ab48ed1c08134c5e89619a76859447666

SHA512
8c10fa5717a2924ee42a16ff1be41fdfe0d404320e9f659b0d4099c543f9b22ef315cf4341af57aef126bb8d1edd410da135e5ff7bbf76d454e022b9fe96eecd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45211.exe

Filesize
468KB

MD5
923e3b1e1d763bbabb2eb63783ff0df3

SHA1
c39f9c6f1b830f1ad7782414ac54f96f65382c77

SHA256
a4cf13afcd0f31802b6fd7cc3fde05cdf7f8f5bda166a2c814822e1cabf25bde

SHA512
53ec7be98adaab4ad4d3ef090b52bcdcbd376ed69047388a2afcee1786a3663cbf0fd84a32ae7047b822892e92675911b5a381ffa7db8c1177965aae74308452

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45839.exe

Filesize
468KB

MD5
4f6209271a2de29c6901f8990582a446

SHA1
c9555b7a6218aeab32fa6826b1dfe62699c16fd4

SHA256
db0b5ce65fe43f6142fdf255df20cfc8b317ac990eb8f97cb78da1cd8b805262

SHA512
ec8a9f2b67a920a732ac3ae62f2839e32f8ba2a184b7c5e1ac9f6eb571136492f14c10ad5ceb0a8505c3431ee7f9a0c8312626d5b4515d82a644fb784cf896b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47214.exe

Filesize
468KB

MD5
981aaf2bd16d0067b7f510a4b93bf74f

SHA1
e13b41c19e7554784f41106391b75ffedce94f1d

SHA256
8d04cca9fa105ee68e7fcf2a6e6a3a46304215b496ee4b8eb387d5071fb554d3

SHA512
7cbb84df7c6b2cb12ff6d1cfec139e086e840a9f46035244c32a9e1881bb2d2825758cbed771827ef3020746121b436fbb8f1ea1f8322e9b2755fe4860bba1d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47323.exe

Filesize
468KB

MD5
a4487f7f2045128f7ee77668afae6ec6

SHA1
fdde571bea6ea8cfc33555356597a156cc6c0f39

SHA256
18bf4bba888f381fb21882ed6328efe07a81e6647d740721e132efb859e76760

SHA512
ccdd67a413a9f9e2eb7d965417274c3c754262b2754248db4b446c55c9d792fc72a5c777ac28815d8bd38f3f3473185134cc8737579d74c32bc0fce9ad4052ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49731.exe

Filesize
468KB

MD5
1076f9d175147e74753e9c9e64498f27

SHA1
f8dea84e1e1c3fd982ced545a5512300255a6d28

SHA256
fda4131a081c919de17bfb93b5c96bc4bd800ce91d6f141518bc91ff87a6969a

SHA512
f46ca167aeba2fa067368977f6476818662d74cba0836948564611cf5b42f91f3427b4e61f84edb16e0037fff74bbf956dc3506853473ac29f7e7d289f4c9bbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50286.exe

Filesize
468KB

MD5
451058739369616e5af670411a55baba

SHA1
eb81c07222b62eec0d4b70c255a9654cd0e3f3af

SHA256
5d374788966f0f7d9f07b7ba913b7b83b82ea69a2916687fa90d848cfdaaae90

SHA512
9ee721e4a658229b51a8c41ea8a30b5202e85d1e3fa942271b28943ccf42126c10a2fac50a420f3f1af039da1c7bcd918e9ea44a2640b9846c8cdb0912e41e81

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50809.exe

Filesize
468KB

MD5
d263fc3d88b1b03a3ecbe2e97ce13a10

SHA1
3c113f5fc09f9b8102b5e0be91747e9bbfeeec31

SHA256
7937c542c278c5110d3ebdd49464a4eff8e21df7ef7ad62e1c1fb5dc51a14a28

SHA512
c6df76c11433c48d1c2baaa1796f43cc52778ccbf24c9364ec5eff8bdaadd9fcf6da7a49c4def92ba0daed53d9baec41bf897fb0db63f836a953c2f61607fb18

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51769.exe

Filesize
468KB

MD5
a0486456a8b03303d16abb93abf2080a

SHA1
d1b1636f0d74f68a43ee02de2fc8da8d7107ebba

SHA256
25f7c0a530a9f3e018636355e34618352834e56ac97a590af163165845bcfa6c

SHA512
120ced090a6766e25962ce89652b20f5fb14207a90d6e1e39678637b47631785d3353dc7c0c0e07084ecd0c03384e9be6219461f1f7e7ffea0ff2ae15e26d631

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53047.exe

Filesize
468KB

MD5
0081871e8b02df1fc14bfa214bf90bb0

SHA1
368f472490829bf3fa17219c9842c820b324e2a5

SHA256
8c2b2a594ed85b2e9b669f70b27e014ed380537eb158df2f01fb7fa53789d808

SHA512
6fbad824bd8e52f291ee675c29c006e1b2b09aca08f3e0ee9db519d1dbad9a57d3cebd5a7a28bdaeea289d26d9536224a8048692eab3467d80422d7105d2d17a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56083.exe

Filesize
468KB

MD5
7fbeca4d4774b0ef79e0b50994ad1fde

SHA1
38b196722b8649d51f20cdebc5b6fef68d7d8884

SHA256
f016239bbe9763f7a4a84fb7a2aee8a0a4754a3918f08c15ec7e1908458d08e2

SHA512
9af712d491074352174189ae5b84e3899596fa40ad5ea3b9d84cd6c7a3c103d559ed3caf05c45830366c550944a6c70c211342ddbee0005cdbcfea576ea06f4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59978.exe

Filesize
468KB

MD5
a5e6709b3d0399780ca071a2314ef73d

SHA1
c431ce8d470f591c6af0e2884dfba262af281251

SHA256
6799a5c4e4c7c06cdee12ce13d7e3f88060fe6a913ef6ef6902bc7d55ed1c00c

SHA512
65e87d8112a720372a5daa6b0780e8fc584a25edd0ff96388201a96cee52693df2f47539b5f7d78ac55015212295431d3924bb3c2541884bb3cea8b393938ada

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60949.exe

Filesize
468KB

MD5
391e4c22698541503090c789e5dc8ca3

SHA1
ec8552be60958e064e46b95ee6a8ea9e9269cff4

SHA256
8cb10a8024111f65d8370918c190c134079e17907bc08c002b9e45a7c4a9b272

SHA512
6808760715da319f4cc40d3b893a194a2bc9500dff92c84e3abd0550b1106d93eaffa98caeab487e6a7b32c0e5d70df344877f7eeff7069c2cd54af4ccc55685

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61075.exe

Filesize
468KB

MD5
e0f7cb113ffdd54cfcf8ce96c61257d4

SHA1
74579b817b82d9454801399651b481bbaec38828

SHA256
24b2891f76ba01d5a1bd4e3cb08cbddd8ffb6a222653a93308258f2b5d5d1e96

SHA512
6ef851ce3ce7b47e5a8b92825e97336c48b841a143c34944e411bc3b73c2419fee31e657a7685436fe48efe30251782d4009fdeba3b56db3bac6cc4e30c2a9aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62102.exe

Filesize
468KB

MD5
cc510992e3a7afa143e92793461817c4

SHA1
df2e2c6921387570ce301e5b28aa12e87058b86e

SHA256
c704e432ca2d252293be2a799da38c9e2da1dec2203561fa56ff1e4b8220d76f

SHA512
b2f4c87bf38f7ba93b3f8b676fa47a85e155eed20d8a8fd4906a08e6c5d8d4f2c9efbfff176eaf2669d62c8989dacb036f240ca0c9331b4811bd64e2176aebe9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62730.exe

Filesize
468KB

MD5
c94b087edcf4e79ae012489b611b0b74

SHA1
af3e4d8ad1466740651398c9a64a080003a9b3cc

SHA256
4b4e8778cfd917d8139810a852c976112aec67b8f45730bd74fdacb738e611ab

SHA512
fd45c63077049dd9533cb4ba56adc80c5cbbd59264d59c46fd3096d9eef49334262739cfdea1b0e7a4233c216faab766dd660ae436ce9adc4aa32d389fad06c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63113.exe

Filesize
468KB

MD5
bf8b491bba9cc2ae128ee312d338bdba

SHA1
937ac511817ea0252ccc2e8a185ac63f5d5ec8da

SHA256
7aa785a9bce7fff5ae76ffb423df2af71df7c2994d67267dfc0cc0112a1970c8

SHA512
c8fce0ab2f5f10a1aaf56f5075e34de18d6c63948010a035bd7c7590707b1e98197f8f2a053b9cf07bac95095e8b43a984a2b9e3d201226bcf1fd044896841de

Download Submit
memory/32-19-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/112-363-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/116-406-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/184-97-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/208-450-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/252-448-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/440-111-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/660-269-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/772-272-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/880-215-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/924-249-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1036-218-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1048-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1096-276-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1104-55-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1136-294-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1164-131-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1504-279-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1580-147-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1688-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1752-424-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1844-242-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1848-330-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1852-268-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1928-401-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1980-355-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2056-96-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2068-214-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2080-377-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2164-331-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2348-381-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2416-7-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2480-432-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2496-352-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2508-347-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2532-317-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2536-89-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2588-122-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2664-383-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2740-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2792-378-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2928-167-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3004-361-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3080-63-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3100-376-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3132-428-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3176-219-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3244-225-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3328-364-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3340-447-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3400-404-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3432-423-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3596-471-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3624-252-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3628-449-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3672-256-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3744-90-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3768-318-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3776-91-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3800-235-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3900-119-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3932-332-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4052-156-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4172-187-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4204-230-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4212-405-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4240-70-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4308-138-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4440-362-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4460-295-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4528-333-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4532-46-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4536-37-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4580-403-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4816-217-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4900-45-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4952-188-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5016-216-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5092-365-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5152-470-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5208-475-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5224-474-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5320-490-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5356-526-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5408-527-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5420-530-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5464-532-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5508-541-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5516-534-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5524-542-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5564-535-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5576-536-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5588-537-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5600-538-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5616-539-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5640-540-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/9608-3327-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/10288-3326-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads