fbc51444a348853a6edf1f6be25d1f0e4cfdc6dc31e52d7489aa9ebcc8fd0b53

Analysis

max time kernel
119s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2024, 01:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

db2e3249df580a8b787c4b33fbd5cfa0N.exe
Size

468KB
MD5

db2e3249df580a8b787c4b33fbd5cfa0
SHA1

d939156c28f6b0d32fc862435e7ec265f2cef7df
SHA256

fbc51444a348853a6edf1f6be25d1f0e4cfdc6dc31e52d7489aa9ebcc8fd0b53
SHA512

cdb513600b19ca67ba6ebf1ee42abec1420bc20062ccc1cca2e89c6e7740d165a0a2da7ee584eebcfba7f158d2ad0df6dd89671883504cc45f3fd0c5cf13d47b
SSDEEP

3072:auNhogfxjg8UdbYZPUGcqf8/7C3jyIgZPwfI+V8xTxB+r20Mt5MB:auTogNUdaPLcqfQV35Tx0y0Mt

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2384	Unicorn-13099.exe
4252	Unicorn-62482.exe
1640	Unicorn-27157.exe
2260	Unicorn-59343.exe
1988	Unicorn-36384.exe
5072	Unicorn-7765.exe
3748	Unicorn-27631.exe
5064	Unicorn-19212.exe
1944	Unicorn-44790.exe
4860	Unicorn-47634.exe
2580	Unicorn-12309.exe
4728	Unicorn-16716.exe
4640	Unicorn-32175.exe
4260	Unicorn-65158.exe
4308	Unicorn-59293.exe
4712	Unicorn-31532.exe
3728	Unicorn-31733.exe
4528	Unicorn-3851.exe
2280	Unicorn-50063.exe
4872	Unicorn-43933.exe
2752	Unicorn-2050.exe
532	Unicorn-54806.exe
976	Unicorn-53850.exe
4016	Unicorn-60172.exe
3696	Unicorn-60172.exe
2320	Unicorn-4754.exe
4352	Unicorn-30956.exe
3980	Unicorn-59980.exe
3584	Unicorn-53078.exe
4144	Unicorn-59980.exe
3940	Unicorn-65167.exe
4448	Unicorn-45110.exe
1956	Unicorn-42810.exe
2712	Unicorn-64399.exe
4940	Unicorn-44534.exe
3916	Unicorn-47378.exe
2960	Unicorn-53683.exe
4952	Unicorn-23974.exe
3036	Unicorn-8971.exe
1532	Unicorn-39724.exe
3772	Unicorn-22511.exe
4560	Unicorn-19858.exe
1284	Unicorn-43564.exe
4992	Unicorn-42505.exe
3324	Unicorn-49133.exe
2728	Unicorn-49615.exe
4568	Unicorn-33554.exe
2224	Unicorn-15250.exe
5096	Unicorn-33554.exe
3740	Unicorn-9660.exe
4840	Unicorn-41949.exe
2132	Unicorn-27449.exe
2144	Unicorn-48079.exe
5036	Unicorn-12152.exe
5088	Unicorn-32018.exe
2624	Unicorn-27413.exe
3112	Unicorn-33013.exe
2480	Unicorn-33013.exe
3676	Unicorn-65100.exe
2396	Unicorn-45199.exe
3056	Unicorn-22047.exe
5028	Unicorn-43122.exe
1328	Unicorn-3502.exe
2456	Unicorn-21292.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
14528	14232	WerFault.exe	677

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53346.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47478.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45724.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21727.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26165.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4770.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32018.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23352.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34933.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14072.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57327.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37388.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37368.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56652.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6673.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2891.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10883.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1634.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15250.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62450.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62450.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5215.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61452.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60739.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43922.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37658.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6940.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22072.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24991.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14239.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32175.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31503.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32021.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57780.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31298.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19858.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9627.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23352.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56820.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39499.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2874.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62450.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20850.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25627.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29196.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62450.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35328.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42082.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53078.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33554.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23352.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62450.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65339.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29266.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48114.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11739.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36898.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50261.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28082.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14402.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26860.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2251.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41498.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4395.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	6100	dwm.exe
Token: SeChangeNotifyPrivilege	6100	dwm.exe
Token: 33	6100	dwm.exe
Token: SeIncBasePriorityPrivilege	6100	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
5112	db2e3249df580a8b787c4b33fbd5cfa0N.exe
2384	Unicorn-13099.exe
1640	Unicorn-27157.exe
4252	Unicorn-62482.exe
2260	Unicorn-59343.exe
1988	Unicorn-36384.exe
3748	Unicorn-27631.exe
5072	Unicorn-7765.exe
5064	Unicorn-19212.exe
1944	Unicorn-44790.exe
4860	Unicorn-47634.exe
4728	Unicorn-16716.exe
4640	Unicorn-32175.exe
2580	Unicorn-12309.exe
4308	Unicorn-59293.exe
4260	Unicorn-65158.exe
4712	Unicorn-31532.exe
3728	Unicorn-31733.exe
4528	Unicorn-3851.exe
4872	Unicorn-43933.exe
2280	Unicorn-50063.exe
2752	Unicorn-2050.exe
976	Unicorn-53850.exe
4016	Unicorn-60172.exe
3696	Unicorn-60172.exe
532	Unicorn-54806.exe
3980	Unicorn-59980.exe
2320	Unicorn-4754.exe
3584	Unicorn-53078.exe
4352	Unicorn-30956.exe
4144	Unicorn-59980.exe
3940	Unicorn-65167.exe
4448	Unicorn-45110.exe
2712	Unicorn-64399.exe
1956	Unicorn-42810.exe
3916	Unicorn-47378.exe
4940	Unicorn-44534.exe
2960	Unicorn-53683.exe
4952	Unicorn-23974.exe
3036	Unicorn-8971.exe
1532	Unicorn-39724.exe
1284	Unicorn-43564.exe
4560	Unicorn-19858.exe
4992	Unicorn-42505.exe
3772	Unicorn-22511.exe
3324	Unicorn-49133.exe
2728	Unicorn-49615.exe
4568	Unicorn-33554.exe
2224	Unicorn-15250.exe
3740	Unicorn-9660.exe
5096	Unicorn-33554.exe
4840	Unicorn-41949.exe
2132	Unicorn-27449.exe
5036	Unicorn-12152.exe
5088	Unicorn-32018.exe
2480	Unicorn-33013.exe
2144	Unicorn-48079.exe
2624	Unicorn-27413.exe
3112	Unicorn-33013.exe
3676	Unicorn-65100.exe
2396	Unicorn-45199.exe
3056	Unicorn-22047.exe
5028	Unicorn-43122.exe
1328	Unicorn-3502.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5112 wrote to memory of 2384	5112	db2e3249df580a8b787c4b33fbd5cfa0N.exe	87
PID 5112 wrote to memory of 2384	5112	db2e3249df580a8b787c4b33fbd5cfa0N.exe	87
PID 5112 wrote to memory of 2384	5112	db2e3249df580a8b787c4b33fbd5cfa0N.exe	87
PID 2384 wrote to memory of 4252	2384	Unicorn-13099.exe	88
PID 2384 wrote to memory of 4252	2384	Unicorn-13099.exe	88
PID 2384 wrote to memory of 4252	2384	Unicorn-13099.exe	88
PID 5112 wrote to memory of 1640	5112	db2e3249df580a8b787c4b33fbd5cfa0N.exe	89
PID 5112 wrote to memory of 1640	5112	db2e3249df580a8b787c4b33fbd5cfa0N.exe	89
PID 5112 wrote to memory of 1640	5112	db2e3249df580a8b787c4b33fbd5cfa0N.exe	89
PID 1640 wrote to memory of 2260	1640	Unicorn-27157.exe	90
PID 1640 wrote to memory of 2260	1640	Unicorn-27157.exe	90
PID 1640 wrote to memory of 2260	1640	Unicorn-27157.exe	90
PID 5112 wrote to memory of 1988	5112	db2e3249df580a8b787c4b33fbd5cfa0N.exe	91
PID 5112 wrote to memory of 1988	5112	db2e3249df580a8b787c4b33fbd5cfa0N.exe	91
PID 5112 wrote to memory of 1988	5112	db2e3249df580a8b787c4b33fbd5cfa0N.exe	91
PID 2384 wrote to memory of 5072	2384	Unicorn-13099.exe	93
PID 2384 wrote to memory of 5072	2384	Unicorn-13099.exe	93
PID 2384 wrote to memory of 5072	2384	Unicorn-13099.exe	93
PID 4252 wrote to memory of 3748	4252	Unicorn-62482.exe	92
PID 4252 wrote to memory of 3748	4252	Unicorn-62482.exe	92
PID 4252 wrote to memory of 3748	4252	Unicorn-62482.exe	92
PID 2260 wrote to memory of 5064	2260	Unicorn-59343.exe	94
PID 2260 wrote to memory of 5064	2260	Unicorn-59343.exe	94
PID 2260 wrote to memory of 5064	2260	Unicorn-59343.exe	94
PID 1640 wrote to memory of 1944	1640	Unicorn-27157.exe	95
PID 1640 wrote to memory of 1944	1640	Unicorn-27157.exe	95
PID 1640 wrote to memory of 1944	1640	Unicorn-27157.exe	95
PID 3748 wrote to memory of 4860	3748	Unicorn-27631.exe	96
PID 3748 wrote to memory of 4860	3748	Unicorn-27631.exe	96
PID 3748 wrote to memory of 4860	3748	Unicorn-27631.exe	96
PID 4252 wrote to memory of 2580	4252	Unicorn-62482.exe	98
PID 4252 wrote to memory of 2580	4252	Unicorn-62482.exe	98
PID 4252 wrote to memory of 2580	4252	Unicorn-62482.exe	98
PID 1988 wrote to memory of 4728	1988	Unicorn-36384.exe	99
PID 1988 wrote to memory of 4728	1988	Unicorn-36384.exe	99
PID 1988 wrote to memory of 4728	1988	Unicorn-36384.exe	99
PID 5072 wrote to memory of 4640	5072	Unicorn-7765.exe	97
PID 5072 wrote to memory of 4640	5072	Unicorn-7765.exe	97
PID 5072 wrote to memory of 4640	5072	Unicorn-7765.exe	97
PID 5112 wrote to memory of 4260	5112	db2e3249df580a8b787c4b33fbd5cfa0N.exe	100
PID 5112 wrote to memory of 4260	5112	db2e3249df580a8b787c4b33fbd5cfa0N.exe	100
PID 5112 wrote to memory of 4260	5112	db2e3249df580a8b787c4b33fbd5cfa0N.exe	100
PID 2384 wrote to memory of 4308	2384	Unicorn-13099.exe	101
PID 2384 wrote to memory of 4308	2384	Unicorn-13099.exe	101
PID 2384 wrote to memory of 4308	2384	Unicorn-13099.exe	101
PID 5064 wrote to memory of 4712	5064	Unicorn-19212.exe	102
PID 5064 wrote to memory of 4712	5064	Unicorn-19212.exe	102
PID 5064 wrote to memory of 4712	5064	Unicorn-19212.exe	102
PID 2260 wrote to memory of 3728	2260	Unicorn-59343.exe	103
PID 2260 wrote to memory of 3728	2260	Unicorn-59343.exe	103
PID 2260 wrote to memory of 3728	2260	Unicorn-59343.exe	103
PID 1944 wrote to memory of 4528	1944	Unicorn-44790.exe	104
PID 1944 wrote to memory of 4528	1944	Unicorn-44790.exe	104
PID 1944 wrote to memory of 4528	1944	Unicorn-44790.exe	104
PID 1640 wrote to memory of 4872	1640	Unicorn-27157.exe	105
PID 1640 wrote to memory of 4872	1640	Unicorn-27157.exe	105
PID 1640 wrote to memory of 4872	1640	Unicorn-27157.exe	105
PID 4308 wrote to memory of 2280	4308	Unicorn-59293.exe	106
PID 4308 wrote to memory of 2280	4308	Unicorn-59293.exe	106
PID 4308 wrote to memory of 2280	4308	Unicorn-59293.exe	106
PID 2384 wrote to memory of 2752	2384	Unicorn-13099.exe	107
PID 2384 wrote to memory of 2752	2384	Unicorn-13099.exe	107
PID 2384 wrote to memory of 2752	2384	Unicorn-13099.exe	107
PID 3748 wrote to memory of 532	3748	Unicorn-27631.exe	108

C:\Users\Admin\AppData\Local\Temp\db2e3249df580a8b787c4b33fbd5cfa0N.exe
"C:\Users\Admin\AppData\Local\Temp\db2e3249df580a8b787c4b33fbd5cfa0N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5112
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13099.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13099.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62482.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62482.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27631.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27631.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47634.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44534.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40399.exe
        7⤵
        
        PID:3792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41269.exe
        8⤵
        
        PID:5852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22194.exe
        9⤵
        
        PID:8112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11796.exe
        10⤵
        
        PID:10336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46257.exe
        10⤵
        
        PID:2476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28059.exe
        9⤵
        
        PID:10632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51936.exe
        8⤵
        
        PID:9028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59989.exe
        9⤵
        
        PID:13860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47404.exe
        8⤵
        
        PID:12456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56220.exe
        9⤵
        
        PID:16000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15347.exe
        8⤵
        
        PID:15300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36482.exe
        8⤵
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18475.exe
        7⤵
        
        PID:8656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60943.exe
        8⤵
        
        PID:10600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13563.exe
        8⤵
        
        PID:13792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23164.exe
        8⤵
        
        PID:1716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54867.exe
        7⤵
        
        PID:10920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39544.exe
        8⤵
        
        PID:14868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45331.exe
        8⤵
        
        PID:14576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14402.exe
        8⤵
        
        PID:14768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19769.exe
        6⤵
        
        PID:1960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41595.exe
        7⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50261.exe
        8⤵
        
        PID:8932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48889.exe
        9⤵
        
        PID:14172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34933.exe
        8⤵
        
        PID:12040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46257.exe
        8⤵
        
        PID:4516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25698.exe
        7⤵
        
        PID:6616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26933.exe
        8⤵
        
        PID:13700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37638.exe
        7⤵
        
        PID:11996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43847.exe
        7⤵
        
        PID:14544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53387.exe
        7⤵
        
        PID:16044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13256.exe
        6⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60306.exe
        7⤵
        
        PID:9184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56569.exe
        7⤵
        
        PID:13600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51299.exe
        7⤵
        
        PID:3160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55891.exe
        6⤵
        
        PID:6820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20027.exe
        6⤵
        
        PID:14168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5946.exe
        6⤵
        
        PID:2956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54806.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9781.exe
        6⤵
        
        PID:4504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43506.exe
        7⤵
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-433.exe
        8⤵
        
        PID:8564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45782.exe
        8⤵
        
        PID:9204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44956.exe
        7⤵
        
        PID:4396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-499.exe
        7⤵
        
        PID:1800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18943.exe
        6⤵
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13201.exe
        7⤵
        
        PID:10400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45154.exe
        7⤵
        
        PID:5828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29196.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38405.exe
        6⤵
        
        PID:14780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24476.exe
        6⤵
        
        PID:14816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27449.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25999.exe
        6⤵
        
        PID:5052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31503.exe
        7⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59346.exe
        8⤵
        
        PID:9076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16216.exe
        8⤵
        
        PID:14208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51613.exe
        8⤵
        
        PID:6952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45724.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7074.exe
        7⤵
        
        PID:15896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58742.exe
        6⤵
        
        PID:7316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60943.exe
        7⤵
        
        PID:10616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14379.exe
        7⤵
        
        PID:16016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23263.exe
        6⤵
        
        PID:10168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29100.exe
        6⤵
        
        PID:13644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57588.exe
        6⤵
        
        PID:15992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12578.exe
        5⤵
        
        PID:5208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43506.exe
        6⤵
        
        PID:1500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61330.exe
        7⤵
        
        PID:6856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14072.exe
        7⤵
        
        PID:12884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5215.exe
        7⤵
        
        PID:15044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57954.exe
        7⤵
        
        PID:5316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38299.exe
        6⤵
        
        PID:7940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35328.exe
        6⤵
        
        PID:12528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15567.exe
        5⤵
        
        PID:7108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62450.exe
        6⤵
        
        PID:10264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9499.exe
        6⤵
        
        PID:13896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-866.exe
        6⤵
        
        PID:6584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20824.exe
        5⤵
        
        PID:9520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51219.exe
        5⤵
        
        PID:6868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12309.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12309.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60172.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32018.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6673.exe
        7⤵
        
        PID:2196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56085.exe
        8⤵
        
        PID:6424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30706.exe
        9⤵
        
        PID:8048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16216.exe
        9⤵
        
        PID:14232
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14232 -s 472
        10⤵
        Program crash
        
        PID:14528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47005.exe
        9⤵
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23544.exe
        8⤵
        
        PID:9336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61611.exe
        8⤵
        
        PID:4612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50076.exe
        7⤵
        
        PID:7984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61874.exe
        8⤵
        
        PID:9656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9499.exe
        8⤵
        
        PID:940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59.exe
        8⤵
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1634.exe
        8⤵
        
        PID:14600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26527.exe
        7⤵
        
        PID:10748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8245.exe
        6⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40434.exe
        7⤵
        
        PID:6296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25429.exe
        8⤵
        
        PID:2792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23211.exe
        8⤵
        
        PID:15392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23352.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46067.exe
        7⤵
        
        PID:15944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6940.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23864.exe
        7⤵
        
        PID:10684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1634.exe
        7⤵
        
        PID:5104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56621.exe
        6⤵
        
        PID:10736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29852.exe
        6⤵
        
        PID:15836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33013.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12843.exe
        6⤵
        
        PID:5160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40434.exe
        7⤵
        
        PID:6304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62450.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46257.exe
        8⤵
        
        PID:1528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23352.exe
        7⤵
        
        PID:9248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1320.exe
        8⤵
        
        PID:15072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53964.exe
        8⤵
        
        PID:15172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44314.exe
        7⤵
        
        PID:13248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65531.exe
        7⤵
        
        PID:3260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58742.exe
        6⤵
        
        PID:7372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55567.exe
        7⤵
        
        PID:10844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26860.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23263.exe
        6⤵
        
        PID:10116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5331.exe
        7⤵
        
        PID:8504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29100.exe
        6⤵
        
        PID:14180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-499.exe
        6⤵
        
        PID:5288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39962.exe
        5⤵
        
        PID:5256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55125.exe
        6⤵
        
        PID:6228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9457.exe
        7⤵
        
        PID:7584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21592.exe
        7⤵
        
        PID:11780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3928.exe
        6⤵
        
        PID:8432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38922.exe
        6⤵
        
        PID:4376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46067.exe
        6⤵
        
        PID:16028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37388.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16050.exe
        6⤵
        
        PID:11292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23727.exe
        5⤵
        
        PID:10588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47458.exe
        6⤵
        
        PID:4896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19331.exe
        5⤵
        
        PID:5656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53850.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53850.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43564.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64431.exe
        6⤵
        
        PID:756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42162.exe
        7⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60687.exe
        8⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10907.exe
        8⤵
        
        PID:12536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32671.exe
        7⤵
        
        PID:10084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56820.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58742.exe
        6⤵
        
        PID:7404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23263.exe
        6⤵
        
        PID:10096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29874.exe
        5⤵
        
        PID:628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43506.exe
        6⤵
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11249.exe
        7⤵
        
        PID:10456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26860.exe
        7⤵
        
        PID:2688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3259.exe
        6⤵
        
        PID:9980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40922.exe
        6⤵
        
        PID:4064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39145.exe
        5⤵
        
        PID:8200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55381.exe
        6⤵
        
        PID:13568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47619.exe
        6⤵
        
        PID:14024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64916.exe
        6⤵
        
        PID:6884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11439.exe
        5⤵
        
        PID:11732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24370.exe
        5⤵
        
        PID:6576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42505.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42505.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57532.exe
        5⤵
        
        PID:5224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9230.exe
        6⤵
        
        PID:7064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39323.exe
        7⤵
        
        PID:10464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30594.exe
        7⤵
        
        PID:12736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13009.exe
        7⤵
        
        PID:12192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3259.exe
        6⤵
        
        PID:9988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2322.exe
        6⤵
        
        PID:14664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42995.exe
        6⤵
        
        PID:1016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48352.exe
        5⤵
        
        PID:7996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33426.exe
        6⤵
        
        PID:10508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50361.exe
        6⤵
        
        PID:14032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42124.exe
        6⤵
        
        PID:14496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46257.exe
        6⤵
        
        PID:4960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65257.exe
        5⤵
        
        PID:10560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18332.exe
        5⤵
        
        PID:16072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58573.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58573.exe
      4⤵
      PID:3680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43506.exe
        5⤵
        
        PID:6140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42130.exe
        6⤵
        
        PID:8140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10907.exe
        6⤵
        
        PID:12152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11707.exe
        5⤵
        
        PID:4868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39363.exe
        5⤵
        
        PID:14136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19923.exe
        5⤵
        
        PID:14064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65145.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65145.exe
      4⤵
      PID:7164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43922.exe
        5⤵
        
        PID:10504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13563.exe
        5⤵
        
        PID:916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20539.exe
        5⤵
        
        PID:14736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37890.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37890.exe
      4⤵
      PID:10036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27187.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27187.exe
      4⤵
      PID:7104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7765.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7765.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32175.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32175.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60172.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48079.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12843.exe
        7⤵
        
        PID:5144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8309.exe
        8⤵
        
        PID:4080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10673.exe
        9⤵
        
        PID:10572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61219.exe
        8⤵
        
        PID:11296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58742.exe
        7⤵
        
        PID:7412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40207.exe
        8⤵
        
        PID:13252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62851.exe
        8⤵
        
        PID:15984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23263.exe
        7⤵
        
        PID:8412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29100.exe
        7⤵
        
        PID:13948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26034.exe
        6⤵
        
        PID:5292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38322.exe
        7⤵
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20501.exe
        8⤵
        
        PID:8580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30011.exe
        9⤵
        
        PID:15016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6099.exe
        9⤵
        
        PID:13300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56569.exe
        8⤵
        
        PID:13608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46368.exe
        8⤵
        
        PID:13620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17474.exe
        8⤵
        
        PID:8744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64857.exe
        7⤵
        
        PID:7204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63261.exe
        6⤵
        
        PID:7676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65257.exe
        6⤵
        
        PID:9964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41803.exe
        6⤵
        
        PID:5876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12152.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57327.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31503.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28082.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14072.exe
        8⤵
        
        PID:12876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5215.exe
        8⤵
        
        PID:15012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7922.exe
        8⤵
        
        PID:316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8209.exe
        8⤵
        
        PID:6880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55897.exe
        7⤵
        
        PID:7628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35328.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25474.exe
        7⤵
        
        PID:5676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58742.exe
        6⤵
        
        PID:7376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20757.exe
        7⤵
        
        PID:12308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23263.exe
        6⤵
        
        PID:10092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45122.exe
        6⤵
        
        PID:5420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5151.exe
        5⤵
        
        PID:5236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40434.exe
        6⤵
        
        PID:6336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3860.exe
        7⤵
        
        PID:12640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46265.exe
        7⤵
        
        PID:9180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42082.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41333.exe
        6⤵
        
        PID:9232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37658.exe
        6⤵
        
        PID:14712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12805.exe
        5⤵
        
        PID:7292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20463.exe
        5⤵
        
        PID:10076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37260.exe
        6⤵
        
        PID:14744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57812.exe
        6⤵
        
        PID:15160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23602.exe
        5⤵
        
        PID:14972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53078.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53078.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33554.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6673.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11985.exe
        7⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28082.exe
        8⤵
        
        PID:6812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6099.exe
        9⤵
        
        PID:4576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14072.exe
        8⤵
        
        PID:12900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7633.exe
        8⤵
        
        PID:15376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40821.exe
        7⤵
        
        PID:8416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9375.exe
        7⤵
        
        PID:12028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54684.exe
        6⤵
        
        PID:7512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21650.exe
        7⤵
        
        PID:12936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38387.exe
        7⤵
        
        PID:15572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61120.exe
        6⤵
        
        PID:10476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12111.exe
        6⤵
        
        PID:14596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56953.exe
        5⤵
        
        PID:5228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22069.exe
        6⤵
        
        PID:6188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63378.exe
        7⤵
        
        PID:6176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16216.exe
        7⤵
        
        PID:14216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6082.exe
        7⤵
        
        PID:14704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34009.exe
        7⤵
        
        PID:7712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23352.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34754.exe
        6⤵
        
        PID:940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41498.exe
        6⤵
        
        PID:1140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2882.exe
        5⤵
        
        PID:7496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26933.exe
        6⤵
        
        PID:13708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1448.exe
        5⤵
        
        PID:10468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11906.exe
        6⤵
        
        PID:15472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29084.exe
        5⤵
        
        PID:6488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41949.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41949.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43596.exe
        5⤵
        
        PID:1040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52821.exe
        6⤵
        
        PID:4828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25877.exe
        7⤵
        
        PID:6208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61493.exe
        8⤵
        
        PID:11516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2251.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25717.exe
        7⤵
        
        PID:12400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34540.exe
        7⤵
        
        PID:14624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47478.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18347.exe
        6⤵
        
        PID:13580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32787.exe
        6⤵
        
        PID:6448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34616.exe
        5⤵
        
        PID:8040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32210.exe
        6⤵
        
        PID:13068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62988.exe
        6⤵
        
        PID:6572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10991.exe
        5⤵
        
        PID:11784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12578.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12578.exe
      4⤵
      PID:5200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55125.exe
        5⤵
        
        PID:6236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62450.exe
        6⤵
        
        PID:10352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17282.exe
        7⤵
        
        PID:2540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23352.exe
        5⤵
        
        PID:9320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34754.exe
        5⤵
        
        PID:13776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28722.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28722.exe
      4⤵
      PID:8092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14.exe
        5⤵
        
        PID:11504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46960.exe
        5⤵
        
        PID:12632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50077.exe
        5⤵
        
        PID:15448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22459.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22459.exe
      4⤵
      PID:10644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3019.exe
      4⤵
      PID:1316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59293.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59293.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50063.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50063.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22511.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65199.exe
        6⤵
        
        PID:2816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49074.exe
        7⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18930.exe
        8⤵
        
        PID:7572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30549.exe
        9⤵
        
        PID:11152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59148.exe
        9⤵
        
        PID:15776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45657.exe
        8⤵
        
        PID:10768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54025.exe
        8⤵
        
        PID:14628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28587.exe
        8⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39611.exe
        7⤵
        
        PID:6712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46834.exe
        8⤵
        
        PID:13076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61452.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27970.exe
        7⤵
        
        PID:10184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2971.exe
        6⤵
        
        PID:6352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62450.exe
        7⤵
        
        PID:9648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23074.exe
        8⤵
        
        PID:15544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17131.exe
        7⤵
        
        PID:15156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37088.exe
        6⤵
        
        PID:9224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40620.exe
        6⤵
        
        PID:13536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33714.exe
        6⤵
        
        PID:13784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60819.exe
        5⤵
        
        PID:5060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31503.exe
        6⤵
        
        PID:2488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62450.exe
        7⤵
        
        PID:10328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42781.exe
        6⤵
        
        PID:8976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6940.exe
        5⤵
        
        PID:7356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62450.exe
        6⤵
        
        PID:10280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9499.exe
        6⤵
        
        PID:14260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29129.exe
        5⤵
        
        PID:10204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39499.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19858.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65199.exe
        5⤵
        
        PID:2328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42930.exe
        6⤵
        
        PID:5460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42706.exe
        7⤵
        
        PID:8272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21592.exe
        7⤵
        
        PID:12060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5122.exe
        7⤵
        
        PID:14620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63129.exe
        7⤵
        
        PID:3520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37368.exe
        6⤵
        
        PID:8980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54668.exe
        6⤵
        
        PID:13896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4632.exe
        5⤵
        
        PID:7124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46607.exe
        6⤵
        
        PID:9436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11071.exe
        6⤵
        
        PID:14508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23330.exe
        5⤵
        
        PID:9564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23603.exe
        5⤵
        
        PID:2576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26463.exe
        5⤵
        
        PID:1804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59645.exe
      4⤵
      PID:1192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42930.exe
        5⤵
        
        PID:5312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54873.exe
        6⤵
        
        PID:9416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39544.exe
        7⤵
        
        PID:3124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6099.exe
        7⤵
        
        PID:5188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59124.exe
        6⤵
        
        PID:6896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4696.exe
        5⤵
        
        PID:8784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4002.exe
        5⤵
        
        PID:4492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24233.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24233.exe
      4⤵
      PID:7116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59673.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59673.exe
      4⤵
      PID:11680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10883.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10883.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2050.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2050.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39724.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39724.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56652.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41394.exe
        6⤵
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50261.exe
        7⤵
        
        PID:8924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53045.exe
        8⤵
        
        PID:11480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34933.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11963.exe
        6⤵
        
        PID:8128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16863.exe
        6⤵
        
        PID:12744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1634.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58742.exe
        5⤵
        
        PID:7388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58677.exe
        6⤵
        
        PID:9380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20139.exe
        6⤵
        
        PID:2584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23263.exe
        5⤵
        
        PID:10124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52211.exe
        5⤵
        
        PID:5808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44566.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44566.exe
      4⤵
      PID:3280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4305.exe
        5⤵
        
        PID:6008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32021.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46268.exe
        6⤵
        
        PID:12740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5122.exe
        6⤵
        
        PID:14688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25324.exe
        6⤵
        
        PID:15936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22072.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9375.exe
        5⤵
        
        PID:12520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25474.exe
        5⤵
        
        PID:6104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60739.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60739.exe
      4⤵
      PID:7616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62450.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11071.exe
        5⤵
        
        PID:14540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10523.exe
        5⤵
        
        PID:14984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5329.exe
        5⤵
        
        PID:3004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20850.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20850.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55867.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55867.exe
      4⤵
      PID:14824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8746.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8746.exe
      4⤵
      PID:14160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49133.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49133.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49740.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49740.exe
      4⤵
      PID:4008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9681.exe
        5⤵
        
        PID:6076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35925.exe
        6⤵
        
        PID:7248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62450.exe
        7⤵
        
        PID:10256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46257.exe
        7⤵
        
        PID:5332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14235.exe
        6⤵
        
        PID:10216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27436.exe
        7⤵
        
        PID:7148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20762.exe
        6⤵
        
        PID:16080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28760.exe
        5⤵
        
        PID:7968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12511.exe
        5⤵
        
        PID:10440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54902.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54902.exe
      4⤵
      PID:7072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21458.exe
        5⤵
        
        PID:11824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40160.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40160.exe
      4⤵
      PID:10048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29100.exe
      4⤵
      PID:13856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18995.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18995.exe
      4⤵
      PID:15280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57780.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:15956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37237.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37237.exe
    3⤵
    PID:1524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8145.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8145.exe
      4⤵
      PID:5380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15701.exe
        5⤵
        
        PID:8680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4770.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11707.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11707.exe
      4⤵
      PID:1648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13218.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13218.exe
      4⤵
      PID:12180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1598.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1598.exe
    3⤵
    PID:6088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14055.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14055.exe
    3⤵
    PID:9636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64810.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64810.exe
    3⤵
    PID:15536
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27157.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27157.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59343.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59343.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19212.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19212.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31532.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65167.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65100.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10513.exe
        8⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40434.exe
        9⤵
        
        PID:6328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29938.exe
        10⤵
        
        PID:6968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16216.exe
        10⤵
        
        PID:14224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26668.exe
        10⤵
        
        PID:14668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23352.exe
        9⤵
        
        PID:9296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47004.exe
        8⤵
        
        PID:7644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57103.exe
        9⤵
        
        PID:10576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43747.exe
        9⤵
        
        PID:15188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2251.exe
        9⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59392.exe
        8⤵
        
        PID:10728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56820.exe
        8⤵
        
        PID:4864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50067.exe
        7⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40434.exe
        8⤵
        
        PID:6248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8572.exe
        9⤵
        
        PID:15464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23352.exe
        8⤵
        
        PID:9280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20007.exe
        8⤵
        
        PID:15108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63811.exe
        7⤵
        
        PID:7948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3092.exe
        8⤵
        
        PID:10848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14402.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65257.exe
        7⤵
        
        PID:10544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5051.exe
        7⤵
        
        PID:2820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43122.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37644.exe
        7⤵
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40434.exe
        8⤵
        
        PID:6288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43922.exe
        9⤵
        
        PID:10520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9340.exe
        9⤵
        
        PID:4092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48246.exe
        8⤵
        
        PID:9024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34754.exe
        8⤵
        
        PID:13588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47283.exe
        8⤵
        
        PID:13940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41498.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9538.exe
        7⤵
        
        PID:8588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28687.exe
        8⤵
        
        PID:13720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64724.exe
        8⤵
        
        PID:6876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17327.exe
        7⤵
        
        PID:13004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65212.exe
        7⤵
        
        PID:5372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46781.exe
        6⤵
        
        PID:5664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9627.exe
        7⤵
        
        PID:7048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40207.exe
        8⤵
        
        PID:11136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14239.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36428.exe
        6⤵
        
        PID:7880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46834.exe
        7⤵
        
        PID:12956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25474.exe
        7⤵
        
        PID:5672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38995.exe
        6⤵
        
        PID:10608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19946.exe
        6⤵
        
        PID:15200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14208.exe
        6⤵
        
        PID:4576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19331.exe
        6⤵
        
        PID:7156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45110.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45199.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18895.exe
        7⤵
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11316.exe
        8⤵
        
        PID:6672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
        9⤵
        
        PID:11984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13948.exe
        9⤵
        
        PID:1560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54976.exe
        8⤵
        
        PID:11104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60852.exe
        8⤵
        
        PID:5552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1560.exe
        7⤵
        
        PID:6776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51712.exe
        7⤵
        
        PID:10860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4194.exe
        7⤵
        
        PID:5428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17778.exe
        6⤵
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13838.exe
        7⤵
        
        PID:6696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25429.exe
        8⤵
        
        PID:6940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7635.exe
        9⤵
        
        PID:4444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21727.exe
        7⤵
        
        PID:11308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30562.exe
        6⤵
        
        PID:7888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24731.exe
        7⤵
        
        PID:13276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33403.exe
        7⤵
        
        PID:14736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62480.exe
        6⤵
        
        PID:11864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3051.exe
        7⤵
        
        PID:14580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36898.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37532.exe
        6⤵
        
        PID:1348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22047.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4395.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40434.exe
        7⤵
        
        PID:6312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57103.exe
        8⤵
        
        PID:12120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28594.exe
        8⤵
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29740.exe
        8⤵
        
        PID:1632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23352.exe
        7⤵
        
        PID:9312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58742.exe
        6⤵
        
        PID:7364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23263.exe
        6⤵
        
        PID:10136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29100.exe
        6⤵
        
        PID:14188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3426.exe
        6⤵
        
        PID:16008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37379.exe
        5⤵
        
        PID:5648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11316.exe
        6⤵
        
        PID:6640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24908.exe
        6⤵
        
        PID:12392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6058.exe
        6⤵
        
        PID:15056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12495.exe
        5⤵
        
        PID:6996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20757.exe
        6⤵
        
        PID:12564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9340.exe
        6⤵
        
        PID:15784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8635.exe
        5⤵
        
        PID:10324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19331.exe
        5⤵
        
        PID:1804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31733.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31733.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64399.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3502.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35916.exe
        7⤵
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65426.exe
        8⤵
        
        PID:7004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62450.exe
        9⤵
        
        PID:10248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13471.exe
        8⤵
        
        PID:11692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49526.exe
        7⤵
        
        PID:7692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46034.exe
        8⤵
        
        PID:11672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41795.exe
        7⤵
        
        PID:10652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57780.exe
        7⤵
        
        PID:16052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50809.exe
        6⤵
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17679.exe
        7⤵
        
        PID:7024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62450.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51462.exe
        7⤵
        
        PID:12928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2415.exe
        7⤵
        
        PID:15020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7266.exe
        7⤵
        
        PID:1756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60739.exe
        6⤵
        
        PID:7636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30741.exe
        7⤵
        
        PID:10816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23164.exe
        7⤵
        
        PID:1188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65257.exe
        6⤵
        
        PID:10536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57648.exe
        6⤵
        
        PID:11040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62268.exe
        6⤵
        
        PID:15252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4602.exe
        6⤵
        
        PID:2604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53782.exe
        5⤵
        
        PID:3848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29749.exe
        6⤵
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37653.exe
        7⤵
        
        PID:8104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25429.exe
        8⤵
        
        PID:9360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16986.exe
        9⤵
        
        PID:15888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36515.exe
        8⤵
        
        PID:13948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1634.exe
        8⤵
        
        PID:14716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37976.exe
        7⤵
        
        PID:10852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61836.exe
        7⤵
        
        PID:15556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6555.exe
        6⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35637.exe
        7⤵
        
        PID:11796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35884.exe
        7⤵
        
        PID:1448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27970.exe
        6⤵
        
        PID:10412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5186.exe
        5⤵
        
        PID:6656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43922.exe
        6⤵
        
        PID:10556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24555.exe
        6⤵
        
        PID:15400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29196.exe
        5⤵
        
        PID:9588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37724.exe
        5⤵
        
        PID:6592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42810.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42810.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21292.exe
        5⤵
        
        PID:4316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54255.exe
        6⤵
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9627.exe
        7⤵
        
        PID:8188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14239.exe
        7⤵
        
        PID:12068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9538.exe
        6⤵
        
        PID:8596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43922.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59148.exe
        7⤵
        
        PID:15800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2891.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42571.exe
        6⤵
        
        PID:2568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19122.exe
        5⤵
        
        PID:6112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59858.exe
        6⤵
        
        PID:7192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27253.exe
        7⤵
        
        PID:13292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18370.exe
        7⤵
        
        PID:15340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31468.exe
        7⤵
        
        PID:1980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42584.exe
        6⤵
        
        PID:9660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29355.exe
        6⤵
        
        PID:14524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60739.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50723.exe
        6⤵
        
        PID:4632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47660.exe
        5⤵
        
        PID:10708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41995.exe
        5⤵
        
        PID:3188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41094.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41094.exe
      4⤵
      PID:1264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49167.exe
        5⤵
        
        PID:2912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9627.exe
        6⤵
        
        PID:7508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11796.exe
        7⤵
        
        PID:9496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5329.exe
        7⤵
        
        PID:3448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14239.exe
        6⤵
        
        PID:11740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34616.exe
        5⤵
        
        PID:8024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29516.exe
        5⤵
        
        PID:11768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4194.exe
        5⤵
        
        PID:1260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29266.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29266.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-657.exe
        5⤵
        
        PID:6804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39323.exe
        6⤵
        
        PID:10492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-520.exe
        6⤵
        
        PID:14356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21727.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38786.exe
        5⤵
        
        PID:15440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53142.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53142.exe
      4⤵
      PID:7308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31300.exe
        5⤵
        
        PID:14800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20993.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20993.exe
      4⤵
      PID:10192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64971.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64971.exe
      4⤵
      PID:13792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29538.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29538.exe
      4⤵
      PID:15416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44790.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44790.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3851.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3851.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47378.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21292.exe
        6⤵
        Executes dropped EXE
        
        PID:2456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5931.exe
        7⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11316.exe
        8⤵
        
        PID:6664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35637.exe
        9⤵
        
        PID:11808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33403.exe
        9⤵
        
        PID:12152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6097.exe
        9⤵
        
        PID:6568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4706.exe
        8⤵
        
        PID:11124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31298.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34616.exe
        7⤵
        
        PID:8032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62450.exe
        8⤵
        
        PID:9480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1634.exe
        8⤵
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26527.exe
        7⤵
        
        PID:10740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24339.exe
        7⤵
        
        PID:2136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19122.exe
        6⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32946.exe
        7⤵
        
        PID:7036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26165.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32632.exe
        8⤵
        
        PID:3192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22079.exe
        8⤵
        
        PID:14428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58618.exe
        8⤵
        
        PID:14896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39632.exe
        7⤵
        
        PID:12344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-938.exe
        7⤵
        
        PID:14548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49675.exe
        7⤵
        
        PID:700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48544.exe
        6⤵
        
        PID:7908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35637.exe
        7⤵
        
        PID:11816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2827.exe
        7⤵
        
        PID:4488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32393.exe
        6⤵
        
        PID:10688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17387.exe
        6⤵
        
        PID:5520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19957.exe
        5⤵
        
        PID:464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56754.exe
        6⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12302.exe
        7⤵
        
        PID:7216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20757.exe
        8⤵
        
        PID:12544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1721.exe
        9⤵
        
        PID:4000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20523.exe
        8⤵
        
        PID:1948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3451.exe
        7⤵
        
        PID:10160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17816.exe
        7⤵
        
        PID:14956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24063.exe
        6⤵
        
        PID:9096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55392.exe
        7⤵
        
        PID:14588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32063.exe
        7⤵
        
        PID:5068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50476.exe
        6⤵
        
        PID:12644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2415.exe
        6⤵
        
        PID:14976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27411.exe
        6⤵
        
        PID:2500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22783.exe
        5⤵
        
        PID:6620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59989.exe
        6⤵
        
        PID:13820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2297.exe
        6⤵
        
        PID:3416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29196.exe
        5⤵
        
        PID:9600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54451.exe
        5⤵
        
        PID:14200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38405.exe
        5⤵
        
        PID:14764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37532.exe
        5⤵
        
        PID:1536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53683.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53683.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54348.exe
        5⤵
        
        PID:3184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54255.exe
        6⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17679.exe
        7⤵
        
        PID:7016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62450.exe
        8⤵
        
        PID:9444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21866.exe
        9⤵
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5137.exe
        8⤵
        
        PID:14788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39632.exe
        7⤵
        
        PID:8484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34616.exe
        6⤵
        
        PID:7976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29516.exe
        6⤵
        
        PID:12088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-499.exe
        6⤵
        
        PID:972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50041.exe
        5⤵
        
        PID:6092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-657.exe
        6⤵
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62450.exe
        7⤵
        
        PID:10272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5329.exe
        7⤵
        
        PID:14420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9595.exe
        6⤵
        
        PID:9580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57251.exe
        6⤵
        
        PID:14048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65531.exe
        6⤵
        
        PID:15220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48352.exe
        5⤵
        
        PID:8016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9905.exe
        6⤵
        
        PID:12500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25147.exe
        6⤵
        
        PID:4376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59148.exe
        6⤵
        
        PID:6020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62480.exe
        5⤵
        
        PID:11708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29852.exe
        5⤵
        
        PID:15828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33692.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33692.exe
      4⤵
      PID:4596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26127.exe
        5⤵
        
        PID:1720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42898.exe
        6⤵
        
        PID:7956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3860.exe
        7⤵
        
        PID:12820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50723.exe
        7⤵
        
        PID:2232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21592.exe
        6⤵
        
        PID:12132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46257.exe
        6⤵
        
        PID:5324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24991.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29100.exe
        5⤵
        
        PID:14048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4194.exe
        5⤵
        
        PID:952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38156.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38156.exe
      4⤵
      PID:6848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25941.exe
        5⤵
        
        PID:10980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40675.exe
        5⤵
        
        PID:14908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48530.exe
        5⤵
        
        PID:1552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2251.exe
        5⤵
        
        PID:1472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14194.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14194.exe
      4⤵
      PID:9996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10823.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10823.exe
      4⤵
      PID:14484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43933.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43933.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8971.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8971.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58188.exe
        5⤵
        
        PID:2364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35058.exe
        6⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10673.exe
        7⤵
        
        PID:10800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30412.exe
        7⤵
        
        PID:14404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38811.exe
        6⤵
        
        PID:9352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60660.exe
        6⤵
        
        PID:14204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16827.exe
        5⤵
        
        PID:7868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62450.exe
        6⤵
        
        PID:9460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12817.exe
        6⤵
        
        PID:5524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5608.exe
        5⤵
        
        PID:11832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33555.exe
        5⤵
        
        PID:336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15260.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15260.exe
      4⤵
      PID:6032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9627.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62450.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9937.exe
        6⤵
        
        PID:14340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14239.exe
        5⤵
        
        PID:11760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8747.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8747.exe
      4⤵
      PID:7524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13076.exe
        5⤵
        
        PID:12652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37304.exe
        5⤵
        
        PID:14032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35884.exe
        5⤵
        
        PID:3560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58320.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58320.exe
      4⤵
      PID:10484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20291.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20291.exe
      4⤵
      PID:15500
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23974.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23974.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8110.exe
      4⤵
      PID:1572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48114.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50261.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60658.exe
        7⤵
        
        PID:12676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18818.exe
        7⤵
        
        PID:12164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34933.exe
        6⤵
        
        PID:12032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1634.exe
        6⤵
        
        PID:1748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16127.exe
        5⤵
        
        PID:8076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35817.exe
        5⤵
        
        PID:14160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2874.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56988.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56988.exe
      4⤵
      PID:6648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43474.exe
        5⤵
        
        PID:7172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17051.exe
        5⤵
        
        PID:12852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34849.exe
        5⤵
        
        PID:15036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3066.exe
        5⤵
        
        PID:1808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1602.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1602.exe
      4⤵
      PID:8308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59989.exe
        5⤵
        
        PID:13868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47532.exe
      4⤵
      PID:11040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32428.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32428.exe
    3⤵
    PID:3760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41269.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41269.exe
      4⤵
      PID:5744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28658.exe
        5⤵
        
        PID:6928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57877.exe
        6⤵
        
        PID:13916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14072.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5215.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5329.exe
        5⤵
        
        PID:60
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23032.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23032.exe
      4⤵
      PID:8132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35328.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35328.exe
      4⤵
      PID:13284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65339.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65339.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:15860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28123.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28123.exe
    3⤵
    PID:6456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26389.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26389.exe
      4⤵
      PID:9328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33042.exe
        5⤵
        
        PID:14580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36122.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36122.exe
      4⤵
      PID:6888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35010.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35010.exe
    3⤵
    PID:668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11739.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11739.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:14452
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36384.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36384.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16716.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16716.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59980.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59257.exe
        5⤵
        
        PID:3536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27445.exe
        6⤵
        
        PID:3904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24085.exe
        7⤵
        
        PID:9404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65531.exe
        7⤵
        
        PID:3756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45724.exe
        6⤵
        
        PID:8388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26992.exe
        6⤵
        
        PID:14516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2882.exe
        5⤵
        
        PID:7488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62450.exe
        6⤵
        
        PID:6708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63568.exe
        6⤵
        
        PID:14628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46257.exe
        6⤵
        
        PID:5536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4815.exe
        5⤵
        
        PID:11844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-938.exe
        5⤵
        
        PID:15292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33013.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33013.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12843.exe
        5⤵
        
        PID:5136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40434.exe
        6⤵
        
        PID:6280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33682.exe
        7⤵
        
        PID:8448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35515.exe
        7⤵
        
        PID:13540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54624.exe
        7⤵
        
        PID:10376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17212.exe
        7⤵
        
        PID:2524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43419.exe
        6⤵
        
        PID:6724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45122.exe
        6⤵
        
        PID:1864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12060.exe
        5⤵
        
        PID:8608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17327.exe
        5⤵
        
        PID:12996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62140.exe
        5⤵
        
        PID:5532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39770.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39770.exe
      4⤵
      PID:5300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29682.exe
        5⤵
        
        PID:6716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37499.exe
        5⤵
        
        PID:8324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62563.exe
        5⤵
        
        PID:11948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9018.exe
        5⤵
        
        PID:1996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12805.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12805.exe
      4⤵
      PID:7300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46834.exe
        5⤵
        
        PID:13016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31023.exe
        5⤵
        
        PID:1804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9794.exe
        5⤵
        
        PID:2592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40085.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40085.exe
      4⤵
      PID:10720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21490.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21490.exe
      4⤵
      PID:15424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4754.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4754.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33554.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33554.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2734.exe
        5⤵
        
        PID:3672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35058.exe
        6⤵
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60370.exe
        7⤵
        
        PID:9128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31023.exe
        8⤵
        
        PID:13696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9794.exe
        8⤵
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14072.exe
        7⤵
        
        PID:12892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38971.exe
        7⤵
        
        PID:14532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5905.exe
        7⤵
        
        PID:6892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50144.exe
        6⤵
        
        PID:8604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5051.exe
        6⤵
        
        PID:2648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62688.exe
        5⤵
        
        PID:8708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60943.exe
        6⤵
        
        PID:10584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63641.exe
        6⤵
        
        PID:14352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23164.exe
        6⤵
        
        PID:2852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63532.exe
        5⤵
        
        PID:10808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58515.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58515.exe
      4⤵
      PID:5168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40434.exe
        5⤵
        
        PID:6272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13969.exe
        6⤵
        
        PID:11856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23352.exe
        5⤵
        
        PID:9288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31522.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31522.exe
      4⤵
      PID:8068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5403.exe
        5⤵
        
        PID:14348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6867.exe
        5⤵
        
        PID:14560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62480.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62480.exe
      4⤵
      PID:11804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2259.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2259.exe
      4⤵
      PID:15084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9660.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9660.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6673.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6673.exe
      4⤵
      PID:1768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40434.exe
        5⤵
        
        PID:6320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24562.exe
        6⤵
        
        PID:8940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31023.exe
        7⤵
        
        PID:13856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50723.exe
        7⤵
        
        PID:2400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25627.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11839.exe
        6⤵
        
        PID:14188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58722.exe
        6⤵
        
        PID:15792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23352.exe
        5⤵
        
        PID:9272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51443.exe
        5⤵
        
        PID:15492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58742.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58742.exe
      4⤵
      PID:7396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15893.exe
        5⤵
        
        PID:8436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44314.exe
        5⤵
        
        PID:7440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7674.exe
        5⤵
        
        PID:8384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24098.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24098.exe
      4⤵
      PID:9104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45228.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45228.exe
      4⤵
      PID:14188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22468.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22468.exe
      4⤵
      PID:1188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45122.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45122.exe
      4⤵
      PID:5424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27846.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27846.exe
    3⤵
    PID:5180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40434.exe
      4⤵
      PID:6264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62450.exe
        5⤵
        
        PID:7240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49612.exe
        5⤵
        
        PID:15228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37617.exe
        5⤵
        
        PID:5880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23352.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23352.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
    3⤵
    PID:7332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54613.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54613.exe
      4⤵
      PID:13460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26860.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26860.exe
      4⤵
      PID:1300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3928.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3928.exe
    3⤵
    PID:10044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34732.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34732.exe
    3⤵
    PID:6828
- C:\Users\Admin\AppData\Local\Temp\Unicorn-65158.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-65158.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59980.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59980.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49615.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49615.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63663.exe
        5⤵
        
        PID:4452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28431.exe
        6⤵
        
        PID:5216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42706.exe
        7⤵
        
        PID:8292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4981.exe
        7⤵
        
        PID:13496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32063.exe
        7⤵
        
        PID:14672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42781.exe
        6⤵
        
        PID:9540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11874.exe
        6⤵
        
        PID:2432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55670.exe
        5⤵
        
        PID:2368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55381.exe
        6⤵
        
        PID:13560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2331.exe
        6⤵
        
        PID:15236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49939.exe
        6⤵
        
        PID:14788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37856.exe
        5⤵
        
        PID:9628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52345.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52345.exe
      4⤵
      PID:3492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61461.exe
        5⤵
        
        PID:5748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61906.exe
        6⤵
        
        PID:9064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15608.exe
        6⤵
        
        PID:12624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40689.exe
        6⤵
        
        PID:7012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41589.exe
        5⤵
        
        PID:8208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30786.exe
        5⤵
        
        PID:12872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12817.exe
        5⤵
        
        PID:1736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6940.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6940.exe
      4⤵
      PID:7324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43922.exe
        5⤵
        
        PID:8852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23164.exe
        5⤵
        
        PID:4816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29129.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29129.exe
      4⤵
      PID:9960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6099.exe
        5⤵
        
        PID:540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9956.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9956.exe
      4⤵
      PID:14544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37532.exe
      4⤵
      PID:6156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15250.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15250.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2734.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2734.exe
      4⤵
      PID:3216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8145.exe
        5⤵
        
        PID:5396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15701.exe
        6⤵
        
        PID:8704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9340.exe
        7⤵
        
        PID:1196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39547.exe
        6⤵
        
        PID:13636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5378.exe
        6⤵
        
        PID:14760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37368.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55670.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55670.exe
      4⤵
      PID:6068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35637.exe
        5⤵
        
        PID:11788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25289.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25289.exe
      4⤵
      PID:11160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12586.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12586.exe
      4⤵
      PID:6588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17372.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17372.exe
    3⤵
    PID:3312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40434.exe
      4⤵
      PID:6256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62450.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1634.exe
        5⤵
        
        PID:14804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41333.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41333.exe
      4⤵
      PID:9240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60852.exe
      4⤵
      PID:5708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54217.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54217.exe
    3⤵
    PID:8004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38467.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38467.exe
      4⤵
      PID:13264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24236.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24236.exe
      4⤵
      PID:14032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9937.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9937.exe
      4⤵
      PID:14984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56592.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56592.exe
    3⤵
    PID:11052
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30956.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30956.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39197.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39197.exe
    3⤵
    PID:4720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11316.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11316.exe
      4⤵
      PID:6680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61874.exe
        5⤵
        
        PID:9616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53346.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26424.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26424.exe
      4⤵
      PID:9528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34754.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34754.exe
      4⤵
      PID:14084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42380.exe
      4⤵
      PID:13536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32282.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32282.exe
      4⤵
      PID:14416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14418.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14418.exe
    3⤵
    PID:8404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62450.exe
      4⤵
      PID:10288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37413.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37413.exe
      4⤵
      PID:316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43227.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43227.exe
    3⤵
    PID:11960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31474.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31474.exe
    3⤵
    PID:14456
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27413.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27413.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12843.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12843.exe
    3⤵
    PID:5128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6609.exe
      4⤵
      PID:6200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60943.exe
        5⤵
        
        PID:10620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24700.exe
        5⤵
        
        PID:12204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23544.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23544.exe
      4⤵
      PID:8120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6306.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6306.exe
      4⤵
      PID:15368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17787.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17787.exe
    3⤵
    PID:8060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62450.exe
      4⤵
      PID:9780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46257.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46257.exe
      4⤵
      PID:5328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5608.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5608.exe
    3⤵
    PID:12096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41520.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41520.exe
    3⤵
    PID:14552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11666.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11666.exe
    3⤵
    PID:14032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56820.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56820.exe
    3⤵
    PID:5544
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52959.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52959.exe
  2⤵
  PID:5272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18447.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18447.exe
    3⤵
    PID:6836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60181.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60181.exe
      4⤵
      PID:13796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62563.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62563.exe
    3⤵
    PID:12000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46515.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46515.exe
    3⤵
    PID:14444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37658.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37658.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:896
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40010.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40010.exe
  2⤵
  PID:7924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11458.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11458.exe
    3⤵
    PID:14340
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62929.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62929.exe
  2⤵
  PID:10624
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55202.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55202.exe
  2⤵
  PID:6980

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:6100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-12309.exe

Filesize
468KB

MD5
cb1e49a199ebe25e5e1fbae6383c4184

SHA1
10f3639f35b7940f4f54202058ff16d8539dd424

SHA256
95c0a22e00ccd0f367d3fe1976846f6bbeb2a2c76956784342cb81e7ee438bef

SHA512
ee5b63b548754693bcebf4445ca3c4cc4b50da3d5a7907511b06cf632aa99842a187b4cc700996c7d663bd2b3707e8871cfeaf148e6f25882374249fbd96a7ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13099.exe

Filesize
468KB

MD5
b972a1e7ec3ed98fb554bd8d8bca5e0d

SHA1
a2dfb092d20906e4824958fcdb78202afad0738e

SHA256
02770957d0220481412737329c120adbfe826749b9c07f3b9c3624c66a7f7ad3

SHA512
c021304e307f710f5c98a990065e68ecf6d80e88d48dde0b971951f36294b9eeb699f59eb3109b9d6b2eb5dcd5c2749680ec931f990874773b9487d1907519bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16716.exe

Filesize
468KB

MD5
e26427d0d8cb53e0df7cd8b3d68e99af

SHA1
2ee9237ed6fdab7f3e01a584de7fd906bf169419

SHA256
3db7602731766445c49d1a6c38631cdb42e8b2fb620e60c79341177350a61070

SHA512
1e04a1bdc057a3707a168a689f807b4b0135643a1984879d713c99db948fcc70e0978ba44f5b838493e3be4c7786e5f473672c2049995e57364c37436dda50c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19212.exe

Filesize
468KB

MD5
89995862a06890c8c864677e9b299cab

SHA1
c8e1a47685bb11bf1124191c4a919d9ba69b48eb

SHA256
f07b2248023a18a18e107cfa6e5d9d100c239e827d5cb62fa721670d2af11312

SHA512
5fc5261027722d6e0c5f3b0705dd9281868e3cef7cf506bdba70023a6fd23ed26f0878a0c1c30081a15a7007f36a7964537a552576e51abc7468ec6940ced9dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2050.exe

Filesize
468KB

MD5
7e25cebb98f6d161f69580e0f8ccfeac

SHA1
49a334a23524bd9e8bd9559054ddacb177619c62

SHA256
e91b69e5f415124ddfe3f1af8bc2e3e10ae044ff47d9e9cad0023f11042b32ab

SHA512
7cc4dff8e6e7610f812110777d48efeab6dc403c6a939db4f708b39578340d6ad307a39592622ee5b8b5dac72750c360eb7bf91b183ce234b269617ded5b44e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27157.exe

Filesize
468KB

MD5
1f45b45f4309994cf9eca7984eeb2dbc

SHA1
1e227bbc6809885711b0a59e48c93b0ea3caed6a

SHA256
d05a29caa79e5244e7974df4756ca83638eee2562c19b4a31da345d3a4f96868

SHA512
b0cf6e70166f33b3f54ab1dc36dbab23d2d10a5f687911a7e6a94a8c245443847367e69a0cfefe29451ad7f755d3599bd063ef253555fdaf2179734361f554a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27631.exe

Filesize
468KB

MD5
df708fa903d8796ed6b44cea4b2ecb1c

SHA1
25673a4b486f52fd00757c1b85da6d205c15fba7

SHA256
1f54967ca505ea368c97c4d104f1596119851a1cac7054d6373ff054a91b3119

SHA512
e74ae65e1909bd43412f8b4d12909ec155931e7a5aebac2827a01f5c1ec5e9066c5a055645219fa5cbbd0f1a000f2217901443a2b465d1fe708466ddfeafb4f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30956.exe

Filesize
468KB

MD5
f75825f36e6f049fab45dcf3cfb0abb5

SHA1
99b1ff9eed80dfe6fc6ad34a9b3ed4b5f24d29d5

SHA256
378120bfe17ddb69cdc8862697454201a7ffab776ff8cf82659d24d93f8a84a0

SHA512
9f54cefc7355ad630e00304e3a3545259ee682eec6469290347dfe221e9c7d1d0ec7d5d911526e7561a2abc2a9e96275ddbd94ea5f43ac0153bc3506b49feede

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31532.exe

Filesize
468KB

MD5
b05581df3437df31fa9b4147f6b28139

SHA1
702282d08950b024f238c7b958d154b93b45616c

SHA256
9ed5aabbfcab5561352ac8871f030a9b6e6be7028c387eb55d8f64b97e696722

SHA512
b5dfc7b4cba8321b3f82a412deb7cbf40ea929e99cfed8125bb032fa55d6463b80c119b266a7b60ce22c776855c8e97f909591487b954864a73ddbb4e9ade05c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31733.exe

Filesize
468KB

MD5
57136add690f3c0e4cfcd7cb45dac2e4

SHA1
c781e7a0532d3ce33ef927705bd7f14f1b4ddf44

SHA256
72e874a249017dd26609770070e3f6cefa769a275e38647576a7b99b657def88

SHA512
009389a9a45e00b6a75cec27ac3d41b81372b15da52362ab7178097a2c0ed75e9dd32c5a0d1c1fc8e4efe26c877ef1fdd3f997c67c8606a0b0bc36e27d6e4321

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32175.exe

Filesize
468KB

MD5
d2939b63619f935e3e5cee37143a4c51

SHA1
fe8850103f7908a7df2a3026fbac988d9e971d55

SHA256
bb876db1fc00c967f82c7e3a06fe2596430a58eb78ebb4d4fee8317810bccc51

SHA512
462585d87326e8a762fdc1cac710fd171cbb096ddeaee77ae428f70d3effa1448023486cddad3e8b85e266aaa366ba5a3500d4b8ab3bb3537132738d4a0904fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36384.exe

Filesize
468KB

MD5
ed5512f2150fdc1ee53483c463ff6f6b

SHA1
e4a0ad6d14cee880ad971f34a0e9e5275cecb2cb

SHA256
759b7c5c1a656c62bf5be3ae59832d7b15483bf6830b6c43f1eabe2bcf3c054f

SHA512
03a658077fd0fcfcfca76c8bd79aa73df2a61b6c04e791ac57e993ca0bbb781f9242d68105e57dde5a4d8a9dcac7579c94d99724694e4c8cb05c00ebe3bd524f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3851.exe

Filesize
468KB

MD5
d7324d11335cada097415fba95d2054e

SHA1
2a52f49619f2c5ad0db82b235fa93f3268c4f32e

SHA256
ca541ca157da01db3f683f3f2bbe8c675c7b4a554b4bd82c9101033eaf8b88ee

SHA512
9e5c71ca93e5988349278d4bbb1239112dae33ed66cffa75098cb43857115b89b9ce53e32f314f59f9a59ecc3a815977eb795273202a7de2413791edce61ee85

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43933.exe

Filesize
468KB

MD5
62c06345e0821290b456329c17b662fb

SHA1
5778fc9f875b4b4bd987034dda0abf5fceae0732

SHA256
0c92347d0306b7125ca818b483c8a712c7c8964670fade8dc67cb51f8737d311

SHA512
59b7209acbac081c5f805661196fc651e9a15ac55ec34a6daaab2f0284b6dba3dad1ca2dc6e20ff8491acd99dfc37f87b890b0bce7e1b461c3857b906cd33169

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44790.exe

Filesize
468KB

MD5
e4f02a38abf2af368859835b71407b59

SHA1
d1f98bfbf645d73927224994e9a6964bcb955d01

SHA256
6ac7bf70421c54acc499721c734fcc01fc3fad62a4ae499d7b0d16e488a6959b

SHA512
f4e866549cfc027fb6f4c01e0e25c2d108a2dd27f3e929d6f127dc1890d3dc8f5d21e1f1057d5ca6c1f8987beb29b078a891638f33e95f4788e672acf42df35b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45110.exe

Filesize
468KB

MD5
9a46738467ef86e9c3be7424a35a6bd7

SHA1
0e5c9aac8645cd6d1bc31548b8cd7453566e2a2e

SHA256
610d1f3e88a9c6f17bbdf293fc74ee837e70717064d9b8887c90d0c518d1900f

SHA512
5e85b20783d20b3e4923c8ea5779b4d7e509b06135b825c380e447c733a6f9d3cbc425c66e3006ff635ff004ef2e816a6206dfa9c642f994a01047056020d9ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4706.exe

Filesize
468KB

MD5
70fd1852f47191bbc9d256aa59deaf30

SHA1
6d990b1806e3a6d8c6f74b02e1247a24b3ef4361

SHA256
aae6762f1c1c588e177f8524349bd6df91f22ea1884ef3b5dd752ae57cfbd8ef

SHA512
db9c6939e7f47d6708bc73ef6d9ae5e709b2fc9196d1437420a03f1854f2d8a9cd102e6b8b180b280db7b88d3a796416c58cf5c46f5dd9c6e8ad4097b09c99ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4754.exe

Filesize
468KB

MD5
6afb1b26872dc68c9087074369211d3f

SHA1
a9015dd7960719db5febb79c39b2cddccf74619d

SHA256
cf6d1a7a72219c7198b18b13f59262b154d4dac5011652fed42bf2fa20eb7700

SHA512
1c9d80e7041b5ca02ec9c430ec47ef37c69e3c83cb282a1cc841e6dfeec5d0f196a6a777ebdea85f2165a7d8170a2066dd309e9e4332e640dcd7b9e33aa91e9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47634.exe

Filesize
468KB

MD5
c570684e54a5ffb022250faddaf84e7e

SHA1
09cd27b79fe6a40fd828a7103854ad4094af07a3

SHA256
5da2a9c1d429a18b964153817877d2658d1e2b995f04355fbb790684ddc84204

SHA512
d9ac8ba0b34cc08c1ef7a8e190e3ae97de5553cd201227012e501ab33f7ac6bd57cdd0cfd45c618308b1020a2473a805d6bebac2f0545b2a85b1f79f25922c41

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50063.exe

Filesize
468KB

MD5
393f9ad34f7325131e683a4e93f043f7

SHA1
929191a97c8246759f3683bf8c48934606bcc69e

SHA256
9088a1ec912639c7b1b35aa02c0866ad14cf5d6c54e4a00764e4a682afb06d30

SHA512
a3f9b9f9e2d5247738c392ea3d9ae084aac2e215dce00b359a7f0bb28f3db3e7d8afe838641b9bff498bedddde79afff7a28991d0d192aea689d0b81d7d823c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53078.exe

Filesize
468KB

MD5
d9d0bc7be328de744ce79ed26ddbd182

SHA1
e63ceedb6eced0d672c7b41ef93b41adab6b966e

SHA256
8bac75138f1b70dc8e8a80455e51272401afed5969f9c5d214a2339456805199

SHA512
8aa70426efeb739b7f03fc3c11e0f8268182ac7f0b530bde4490940c2e521401207db6b03c99281526c3b2eb5936199b598ec3cb2496c9a1be3826224112541f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53850.exe

Filesize
468KB

MD5
cc7f39546590648eff60f14d4b3aa855

SHA1
c78b13d04ba61faaa8b0ebed88382c3ab445cb1f

SHA256
f3f471f13cd14891c4c0a7a88b902750ee1a9dccd74b628115a5bc10e4048bb1

SHA512
680cec7802ae55bb59049208c6471532e175ec67bbae7144cd640b68f7a8539940776797f629286f0540643c9e315b44035fe7893f28f57c7ab8bd60aed47ffb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54806.exe

Filesize
468KB

MD5
ef668da9383ec5fdb12d64b1dc8ff29c

SHA1
1b4cb35a4a81e217fe6462560dcb43fd76e5f3b7

SHA256
ebda7667daffcec83717e468439ccbebc7bfa72de4d532d654c03f5cca25c728

SHA512
c1d8ef3388682f6e5a51bce26ce4e3147230a1d2227b9ebf6896b6eed0574900c863337c4d27584da8edec52884519a337cb0128ffdb48349ff6b88fc381030d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59293.exe

Filesize
468KB

MD5
5895cbdc8c9a296d631914dee9abdd66

SHA1
c44bb6bf24e4580d1b2f6a4f151c0b52baa2210c

SHA256
79e82098bfb5ae8d354ae6f7a81813b8bdd2990790adc276656233edd0a9f615

SHA512
25424dc74f5da5dbd4fb8b2f6ac34bc8c1ceb7285883de002e5d92f98fea9b37ce13d7afcdda802667f00f8b4ac39f1889c258ce650cc8c1d5875cf2ccc1e166

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59343.exe

Filesize
468KB

MD5
2e30a75016347d2808502bfbc66751dd

SHA1
de7fb7a7ded4810f25f60c37526e7ac4a51a309a

SHA256
5b97d3f484489d6780d66422b86e6d4b03f0a9ca847e62f8c45fafa61d452d5e

SHA512
10668ecdf10f4a9db2b83e3fd1bcd242725ea0f2c8ff1c7f970036b9bc092cb0b30646cfefbdc1237a67814c2b364b19d63837fd9feee9492f4d36f11c72a3d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59980.exe

Filesize
468KB

MD5
27374311e94e4bed892811fc97fc653b

SHA1
8d1730b4b249662e853faef1fbb17696a1fca927

SHA256
b2c10fa45f12d76c656359e0ac5e9f73805fb672d32ee49b990dab1aa88967e0

SHA512
e26fc8e175102514b3c493797facb9f8a3627eab47b0e2764498404683c44400cba2774946bd0cf675675c0f520f02bcf0130a97630da0bf65041a41297d1ce1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60172.exe

Filesize
468KB

MD5
b533619ce8baa1082888cc8d86471618

SHA1
a889eca9d1167351c2640990e7fe675db78be521

SHA256
e89c7c1ddb661dcd3ae908ef346622ee098f7816c5d5aefbf4ee68c68498da42

SHA512
0286945dedaaea4bd630d0ba4ae4b7062f47dff1a7cb9c36d787bb332acd510304f34f8d246c2fa0c614a92c5df42dec7189c1299f06c08af3eecb30bd4da8a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62482.exe

Filesize
468KB

MD5
38d1796851f223da81719541c383966b

SHA1
d3601c1218d6b0a2a78be186e997919c68dfe041

SHA256
2595145f12150f88b61e30b8cb82a315721f7ecd9db3d4e970378944e0fb942c

SHA512
8aed7b815c7158ead90531fd8beccb1c129d0097a2e195412f5bd9350505a20025fcef540349c760443ce6a21085c4425cfb2893d74e5390591bc7c62853d64a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-65158.exe

Filesize
468KB

MD5
ea33ed50df149c707463ed93da4a3b99

SHA1
4327ec4f5fae6c3377ac6259148946007956d909

SHA256
d87ea0feb2f70086fa888fe89a1457346e4b095e477e7e0c0bbbdb8d88210036

SHA512
8e81c8f47e27c84e7d0a1887ccbaabd1352e4b163e11a2dcca1f00aad42d5fb6fcaf11505436abd0b706ef89e86bdb4deaa4bfc6660157470ddae4995ffe5633

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-65167.exe

Filesize
468KB

MD5
3c1ea02047da932ebb4a5aa9a3de5ecd

SHA1
0ae4ae327d73d3497192293bad05e8462eb49068

SHA256
315b6c3dc0697c30d82edebb97ba6e98ed1f4b64f5ffd5cd3c0120e46740d475

SHA512
4ff15ce1162570b2ff2f7d99852ef2c9d985d7583796bebf55e7b48ad398001a6e83f6972a9b46705fdc6ec8ae593c50d451a3287ae192052f07555e33b25040

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7765.exe

Filesize
468KB

MD5
b54b4289c7f8d87dbeb4f36a377b16b6

SHA1
689cd383b4a3a3440ead7fc029fd2fa18f116fbf

SHA256
ca0e30299f73dc82d9f8d9cd3caa0c398cc65b1ae53a41d30feaadc56ba49826

SHA512
cd8cb4fc9c6f6e93c4f14c559539061d10ffecbfb3a2b477fae5eeaf78c6670a10c6ebaf10184481de20af12c800c3d40650db80698d5f81874b866bdcac8540

Download Submit
memory/464-428-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/532-160-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/628-474-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/756-457-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/976-173-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1040-535-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1192-490-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1264-400-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1284-273-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1328-370-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1524-488-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1532-268-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1572-403-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1640-18-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1768-538-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1944-61-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1956-230-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1960-440-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2132-320-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2144-326-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2224-303-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2260-29-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2280-139-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2320-179-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2328-470-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2332-553-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2364-410-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2384-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2396-360-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2456-375-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2480-335-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2580-85-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2624-336-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2712-232-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2728-292-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2752-150-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2816-509-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2960-245-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3036-261-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3056-362-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3184-378-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3216-505-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3280-469-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3312-542-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3324-286-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3492-537-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3536-479-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3584-193-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3672-532-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3676-351-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3680-519-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3728-118-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3740-310-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3748-50-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3760-402-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3772-269-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3792-399-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3848-404-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3916-241-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3940-212-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3980-197-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4008-478-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4016-174-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4144-195-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4252-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4260-98-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4308-103-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4352-192-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4448-218-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4452-482-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4504-518-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4528-125-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4560-271-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4568-294-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4596-429-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4640-97-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4712-111-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4728-86-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4840-311-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4860-70-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4872-140-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4940-234-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4944-420-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4952-253-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4992-274-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5028-363-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5036-332-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5052-534-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5060-489-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5064-54-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5072-49-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5088-334-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5112-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5128-554-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5168-555-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5208-561-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/9180-2800-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/12028-2930-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14024-3370-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14340-2936-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads