271a568c6eef03ef6246e5b6fbfcc43f76f98287aff0846eb78a9fcc540aa0bf

Analysis

max time kernel
120s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/09/2024, 09:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ef28311ea6798a9ab455925437a6d40N.exe
Size

468KB
MD5

3ef28311ea6798a9ab455925437a6d40
SHA1

01e5947f39aae5ea11d9ca780845ef464a8017fd
SHA256

271a568c6eef03ef6246e5b6fbfcc43f76f98287aff0846eb78a9fcc540aa0bf
SHA512

f38b60f0b6edf422f874c52b5b6932a71a19f9b140acee1171013064ecc2f8181a2f58390da4a884d55cbb3fda458d6d5a72c584c390da31c2d511ca75c986c6
SSDEEP

3072:BqobogCdj08U2bYBPz59ff8/5CK3sXpInmHevVpCZgE3ukYNezlV:BqIoh5U2iP19ffz5S6ZgqLYNe

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1556	Unicorn-12225.exe
832	Unicorn-23216.exe
3448	Unicorn-43082.exe
4928	Unicorn-42646.exe
4512	Unicorn-65104.exe
2992	Unicorn-26118.exe
5068	Unicorn-6252.exe
2660	Unicorn-11701.exe
1412	Unicorn-20424.exe
2936	Unicorn-54580.exe
1184	Unicorn-60710.exe
4424	Unicorn-60445.exe
3284	Unicorn-40844.exe
3104	Unicorn-60710.exe
644	Unicorn-60710.exe
4612	Unicorn-15121.exe
1192	Unicorn-44073.exe
3724	Unicorn-63938.exe
1516	Unicorn-37196.exe
3708	Unicorn-30882.exe
3412	Unicorn-28888.exe
2220	Unicorn-65090.exe
1444	Unicorn-15890.exe
2864	Unicorn-3637.exe
456	Unicorn-13843.exe
2596	Unicorn-11043.exe
4056	Unicorn-108.exe
2108	Unicorn-19708.exe
5096	Unicorn-4192.exe
4508	Unicorn-41930.exe
4212	Unicorn-46569.exe
2412	Unicorn-47529.exe
4516	Unicorn-51613.exe
688	Unicorn-18002.exe
1660	Unicorn-30254.exe
1776	Unicorn-22086.exe
4064	Unicorn-58650.exe
412	Unicorn-21702.exe
4180	Unicorn-15588.exe
2780	Unicorn-33407.exe
2956	Unicorn-39273.exe
1856	Unicorn-6481.exe
3316	Unicorn-26902.exe
1476	Unicorn-45276.exe
1536	Unicorn-27456.exe
3764	Unicorn-51961.exe
2368	Unicorn-159.exe
3940	Unicorn-6289.exe
3924	Unicorn-22626.exe
4188	Unicorn-25748.exe
2752	Unicorn-45084.exe
556	Unicorn-51214.exe
5000	Unicorn-31348.exe
1492	Unicorn-42284.exe
2540	Unicorn-46865.exe
1180	Unicorn-15225.exe
1900	Unicorn-35646.exe
3108	Unicorn-21347.exe
4236	Unicorn-32116.exe
220	Unicorn-3933.exe
4564	Unicorn-18223.exe
3488	Unicorn-18031.exe
4576	Unicorn-28438.exe
4844	Unicorn-7633.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
920	7364	WerFault.exe	320

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47247.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46569.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27338.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10049.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24001.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44139.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62675.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37196.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19554.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64211.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2021.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3770.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20835.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64211.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6407.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8409.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55462.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8245.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57055.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43023.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44973.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59506.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2021.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55462.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-448.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33407.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29686.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55415.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40697.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36980.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18904.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15129.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21725.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39405.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59189.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45903.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59307.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8583.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60710.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25291.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12301.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15557.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19509.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25041.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-589.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36776.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65033.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4691.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4324.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6436.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58798.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13843.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20218.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5904.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45010.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45532.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42646.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26356.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35867.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31783.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20950.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36200.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34972.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	7280	dwm.exe
Token: SeChangeNotifyPrivilege	7280	dwm.exe
Token: 33	7280	dwm.exe
Token: SeIncBasePriorityPrivilege	7280	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4688	3ef28311ea6798a9ab455925437a6d40N.exe
1556	Unicorn-12225.exe
832	Unicorn-23216.exe
3448	Unicorn-43082.exe
4928	Unicorn-42646.exe
2992	Unicorn-26118.exe
5068	Unicorn-6252.exe
4512	Unicorn-65104.exe
2660	Unicorn-11701.exe
1412	Unicorn-20424.exe
644	Unicorn-60710.exe
1184	Unicorn-60710.exe
3284	Unicorn-40844.exe
3104	Unicorn-60710.exe
4424	Unicorn-60445.exe
2936	Unicorn-54580.exe
4612	Unicorn-15121.exe
1192	Unicorn-44073.exe
3724	Unicorn-63938.exe
1516	Unicorn-37196.exe
3708	Unicorn-30882.exe
2864	Unicorn-3637.exe
3412	Unicorn-28888.exe
5096	Unicorn-4192.exe
2220	Unicorn-65090.exe
456	Unicorn-13843.exe
1444	Unicorn-15890.exe
4056	Unicorn-108.exe
2108	Unicorn-19708.exe
2596	Unicorn-11043.exe
4508	Unicorn-41930.exe
4212	Unicorn-46569.exe
2412	Unicorn-47529.exe
4516	Unicorn-51613.exe
688	Unicorn-18002.exe
1660	Unicorn-30254.exe
1776	Unicorn-22086.exe
4064	Unicorn-58650.exe
2780	Unicorn-33407.exe
412	Unicorn-21702.exe
4180	Unicorn-15588.exe
2956	Unicorn-39273.exe
1856	Unicorn-6481.exe
3316	Unicorn-26902.exe
1476	Unicorn-45276.exe
2368	Unicorn-159.exe
3940	Unicorn-6289.exe
3764	Unicorn-51961.exe
1536	Unicorn-27456.exe
3924	Unicorn-22626.exe
4188	Unicorn-25748.exe
2540	Unicorn-46865.exe
556	Unicorn-51214.exe
1492	Unicorn-42284.exe
2752	Unicorn-45084.exe
5000	Unicorn-31348.exe
4236	Unicorn-32116.exe
1180	Unicorn-15225.exe
1900	Unicorn-35646.exe
3108	Unicorn-21347.exe
220	Unicorn-3933.exe
4576	Unicorn-28438.exe
4844	Unicorn-7633.exe
3488	Unicorn-18031.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4688 wrote to memory of 1556	4688	3ef28311ea6798a9ab455925437a6d40N.exe	87
PID 4688 wrote to memory of 1556	4688	3ef28311ea6798a9ab455925437a6d40N.exe	87
PID 4688 wrote to memory of 1556	4688	3ef28311ea6798a9ab455925437a6d40N.exe	87
PID 4688 wrote to memory of 832	4688	3ef28311ea6798a9ab455925437a6d40N.exe	88
PID 4688 wrote to memory of 832	4688	3ef28311ea6798a9ab455925437a6d40N.exe	88
PID 4688 wrote to memory of 832	4688	3ef28311ea6798a9ab455925437a6d40N.exe	88
PID 1556 wrote to memory of 3448	1556	Unicorn-12225.exe	89
PID 1556 wrote to memory of 3448	1556	Unicorn-12225.exe	89
PID 1556 wrote to memory of 3448	1556	Unicorn-12225.exe	89
PID 832 wrote to memory of 4928	832	Unicorn-23216.exe	94
PID 832 wrote to memory of 4928	832	Unicorn-23216.exe	94
PID 832 wrote to memory of 4928	832	Unicorn-23216.exe	94
PID 4688 wrote to memory of 4512	4688	3ef28311ea6798a9ab455925437a6d40N.exe	95
PID 4688 wrote to memory of 4512	4688	3ef28311ea6798a9ab455925437a6d40N.exe	95
PID 4688 wrote to memory of 4512	4688	3ef28311ea6798a9ab455925437a6d40N.exe	95
PID 3448 wrote to memory of 2992	3448	Unicorn-43082.exe	96
PID 3448 wrote to memory of 2992	3448	Unicorn-43082.exe	96
PID 3448 wrote to memory of 2992	3448	Unicorn-43082.exe	96
PID 1556 wrote to memory of 5068	1556	Unicorn-12225.exe	97
PID 1556 wrote to memory of 5068	1556	Unicorn-12225.exe	97
PID 1556 wrote to memory of 5068	1556	Unicorn-12225.exe	97
PID 4928 wrote to memory of 2660	4928	Unicorn-42646.exe	99
PID 4928 wrote to memory of 2660	4928	Unicorn-42646.exe	99
PID 4928 wrote to memory of 2660	4928	Unicorn-42646.exe	99
PID 832 wrote to memory of 1412	832	Unicorn-23216.exe	100
PID 832 wrote to memory of 1412	832	Unicorn-23216.exe	100
PID 832 wrote to memory of 1412	832	Unicorn-23216.exe	100
PID 1556 wrote to memory of 2936	1556	Unicorn-12225.exe	101
PID 1556 wrote to memory of 2936	1556	Unicorn-12225.exe	101
PID 1556 wrote to memory of 2936	1556	Unicorn-12225.exe	101
PID 5068 wrote to memory of 1184	5068	Unicorn-6252.exe	102
PID 5068 wrote to memory of 1184	5068	Unicorn-6252.exe	102
PID 5068 wrote to memory of 1184	5068	Unicorn-6252.exe	102
PID 4512 wrote to memory of 3104	4512	Unicorn-65104.exe	105
PID 4512 wrote to memory of 3104	4512	Unicorn-65104.exe	105
PID 4512 wrote to memory of 3104	4512	Unicorn-65104.exe	105
PID 4688 wrote to memory of 4424	4688	3ef28311ea6798a9ab455925437a6d40N.exe	103
PID 4688 wrote to memory of 4424	4688	3ef28311ea6798a9ab455925437a6d40N.exe	103
PID 4688 wrote to memory of 4424	4688	3ef28311ea6798a9ab455925437a6d40N.exe	103
PID 3448 wrote to memory of 3284	3448	Unicorn-43082.exe	104
PID 3448 wrote to memory of 3284	3448	Unicorn-43082.exe	104
PID 3448 wrote to memory of 3284	3448	Unicorn-43082.exe	104
PID 2992 wrote to memory of 644	2992	Unicorn-26118.exe	106
PID 2992 wrote to memory of 644	2992	Unicorn-26118.exe	106
PID 2992 wrote to memory of 644	2992	Unicorn-26118.exe	106
PID 2660 wrote to memory of 4612	2660	Unicorn-11701.exe	109
PID 2660 wrote to memory of 4612	2660	Unicorn-11701.exe	109
PID 2660 wrote to memory of 4612	2660	Unicorn-11701.exe	109
PID 4928 wrote to memory of 1192	4928	Unicorn-42646.exe	110
PID 4928 wrote to memory of 1192	4928	Unicorn-42646.exe	110
PID 4928 wrote to memory of 1192	4928	Unicorn-42646.exe	110
PID 1412 wrote to memory of 3724	1412	Unicorn-20424.exe	111
PID 1412 wrote to memory of 3724	1412	Unicorn-20424.exe	111
PID 1412 wrote to memory of 3724	1412	Unicorn-20424.exe	111
PID 832 wrote to memory of 1516	832	Unicorn-23216.exe	112
PID 832 wrote to memory of 1516	832	Unicorn-23216.exe	112
PID 832 wrote to memory of 1516	832	Unicorn-23216.exe	112
PID 1184 wrote to memory of 3708	1184	Unicorn-60710.exe	113
PID 1184 wrote to memory of 3708	1184	Unicorn-60710.exe	113
PID 1184 wrote to memory of 3708	1184	Unicorn-60710.exe	113
PID 5068 wrote to memory of 3412	5068	Unicorn-6252.exe	114
PID 5068 wrote to memory of 3412	5068	Unicorn-6252.exe	114
PID 5068 wrote to memory of 3412	5068	Unicorn-6252.exe	114
PID 4424 wrote to memory of 2220	4424	Unicorn-60445.exe	115

C:\Users\Admin\AppData\Local\Temp\3ef28311ea6798a9ab455925437a6d40N.exe
"C:\Users\Admin\AppData\Local\Temp\3ef28311ea6798a9ab455925437a6d40N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4688
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12225.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12225.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43082.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43082.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26118.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26118.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60710.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47529.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3933.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43954.exe
        8⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62623.exe
        9⤵
        
        PID:6924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26879.exe
        10⤵
        
        PID:10928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55986.exe
        10⤵
        
        PID:15000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45115.exe
        10⤵
        
        PID:6548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11829.exe
        9⤵
        
        PID:9756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58045.exe
        9⤵
        
        PID:15244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8053.exe
        9⤵
        
        PID:15424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10085.exe
        8⤵
        
        PID:7808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38777.exe
        8⤵
        
        PID:9428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40330.exe
        8⤵
        
        PID:15164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65313.exe
        7⤵
        
        PID:5476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47247.exe
        8⤵
        
        PID:8292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63613.exe
        8⤵
        
        PID:12772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58413.exe
        7⤵
        
        PID:8456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30226.exe
        7⤵
        
        PID:11996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5477.exe
        7⤵
        
        PID:15648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15641.exe
        7⤵
        
        PID:9568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18223.exe
        6⤵
        Executes dropped EXE
        
        PID:4564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6407.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15498.exe
        8⤵
        
        PID:12424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64211.exe
        8⤵
        
        PID:7352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39110.exe
        7⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9796.exe
        7⤵
        
        PID:13876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24001.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8432.exe
        6⤵
        
        PID:6192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29951.exe
        7⤵
        
        PID:7800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25041.exe
        7⤵
        
        PID:10940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27642.exe
        7⤵
        
        PID:16056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8583.exe
        7⤵
        
        PID:16108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39277.exe
        6⤵
        
        PID:8420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29721.exe
        6⤵
        
        PID:11912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18782.exe
        6⤵
        
        PID:2316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-108.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9340.exe
        6⤵
        
        PID:3464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25418.exe
        7⤵
        
        PID:6788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1082.exe
        8⤵
        
        PID:8660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55462.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8053.exe
        8⤵
        
        PID:15552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2021.exe
        7⤵
        
        PID:9088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6436.exe
        7⤵
        
        PID:13104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62675.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29761.exe
        6⤵
        
        PID:7732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2618.exe
        7⤵
        
        PID:10164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46718.exe
        7⤵
        
        PID:13736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8053.exe
        7⤵
        
        PID:3200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38177.exe
        6⤵
        
        PID:10916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60526.exe
        6⤵
        
        PID:14388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59506.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45084.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18682.exe
        6⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3409.exe
        7⤵
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31207.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46718.exe
        8⤵
        
        PID:13720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20305.exe
        8⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28061.exe
        7⤵
        
        PID:9852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3660.exe
        7⤵
        
        PID:3132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3770.exe
        7⤵
        
        PID:5668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51385.exe
        6⤵
        
        PID:7520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29967.exe
        7⤵
        
        PID:14692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13573.exe
        7⤵
        
        PID:1680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-448.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45061.exe
        6⤵
        
        PID:11168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20189.exe
        6⤵
        
        PID:13872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34781.exe
        6⤵
        
        PID:15580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37748.exe
        6⤵
        
        PID:5824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47389.exe
        5⤵
        
        PID:4964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64478.exe
        6⤵
        
        PID:6884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50335.exe
        7⤵
        
        PID:11356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57055.exe
        7⤵
        
        PID:15708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23785.exe
        6⤵
        
        PID:10076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35949.exe
        6⤵
        
        PID:13652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3386.exe
        6⤵
        
        PID:6828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17587.exe
        5⤵
        
        PID:6384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54279.exe
        6⤵
        
        PID:14912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-937.exe
        6⤵
        
        PID:2268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23875.exe
        6⤵
        
        PID:1596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23805.exe
        5⤵
        
        PID:9488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59719.exe
        5⤵
        
        PID:13780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63707.exe
        5⤵
        
        PID:15740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40844.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40844.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15890.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6481.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38334.exe
        7⤵
        
        PID:2892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62174.exe
        8⤵
        
        PID:6808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11450.exe
        9⤵
        
        PID:8392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63910.exe
        9⤵
        
        PID:12020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2021.exe
        8⤵
        
        PID:9096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6436.exe
        8⤵
        
        PID:13112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8477.exe
        8⤵
        
        PID:16116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8245.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7856.exe
        7⤵
        
        PID:6844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31783.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55462.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61338.exe
        8⤵
        
        PID:972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8932.exe
        7⤵
        
        PID:9964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5249.exe
        7⤵
        
        PID:12948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36980.exe
        7⤵
        
        PID:6416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59117.exe
        6⤵
        
        PID:5160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52610.exe
        7⤵
        
        PID:6584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31295.exe
        8⤵
        
        PID:7912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63407.exe
        9⤵
        
        PID:15264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62966.exe
        9⤵
        
        PID:15456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23105.exe
        9⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34553.exe
        8⤵
        
        PID:11332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64590.exe
        8⤵
        
        PID:16028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24316.exe
        8⤵
        
        PID:1420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57055.exe
        8⤵
        
        PID:15560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65098.exe
        7⤵
        
        PID:8492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11917.exe
        7⤵
        
        PID:12840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59745.exe
        7⤵
        
        PID:6356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48784.exe
        6⤵
        
        PID:7460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2618.exe
        7⤵
        
        PID:10108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46718.exe
        7⤵
        
        PID:13744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8053.exe
        7⤵
        
        PID:15444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5233.exe
        6⤵
        
        PID:5432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5904.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15449.exe
        6⤵
        
        PID:1716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27456.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49796.exe
        6⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55415.exe
        7⤵
        
        PID:7452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25512.exe
        7⤵
        
        PID:12580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8583.exe
        7⤵
        
        PID:2556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45010.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3636.exe
        6⤵
        
        PID:13096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59745.exe
        6⤵
        
        PID:5508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50076.exe
        5⤵
        
        PID:5888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25291.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63407.exe
        7⤵
        
        PID:15300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10853.exe
        7⤵
        
        PID:16068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24081.exe
        6⤵
        
        PID:10292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-484.exe
        6⤵
        
        PID:15340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20305.exe
        6⤵
        
        PID:7140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29686.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18009.exe
        6⤵
        
        PID:16488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35976.exe
        5⤵
        
        PID:11040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11382.exe
        5⤵
        
        PID:14964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13843.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13843.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51214.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52314.exe
        6⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3985.exe
        7⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11658.exe
        8⤵
        
        PID:10888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55794.exe
        8⤵
        
        PID:15256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15209.exe
        8⤵
        
        PID:16520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8409.exe
        7⤵
        
        PID:9168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57521.exe
        7⤵
        
        PID:14000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21265.exe
        7⤵
        
        PID:6488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54242.exe
        6⤵
        
        PID:8176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43023.exe
        7⤵
        
        PID:10864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-589.exe
        7⤵
        
        PID:14420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25964.exe
        7⤵
        
        PID:16004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10470.exe
        7⤵
        
        PID:17188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1636.exe
        6⤵
        
        PID:10728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10049.exe
        6⤵
        
        PID:14980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11938.exe
        6⤵
        
        PID:16336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11836.exe
        5⤵
        
        PID:5872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19554.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51435.exe
        7⤵
        
        PID:9360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55462.exe
        7⤵
        
        PID:3268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8053.exe
        7⤵
        
        PID:1772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7641.exe
        6⤵
        
        PID:9816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3660.exe
        6⤵
        
        PID:11724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32639.exe
        5⤵
        
        PID:7172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5809.exe
        5⤵
        
        PID:10896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11524.exe
        5⤵
        
        PID:14448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48813.exe
        5⤵
        
        PID:16132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37364.exe
        5⤵
        
        PID:15652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46865.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10513.exe
        5⤵
        
        PID:5316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19362.exe
        6⤵
        
        PID:7004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14870.exe
        7⤵
        
        PID:10148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60698.exe
        7⤵
        
        PID:13552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61338.exe
        7⤵
        
        PID:4860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56650.exe
        6⤵
        
        PID:9992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64921.exe
        6⤵
        
        PID:13404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57055.exe
        6⤵
        
        PID:1756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47109.exe
        5⤵
        
        PID:7672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24887.exe
        6⤵
        
        PID:16352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9370.exe
        6⤵
        
        PID:7080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52461.exe
        5⤵
        
        PID:10308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56754.exe
        5⤵
        
        PID:13196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4691.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35215.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35215.exe
      4⤵
      PID:5716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40934.exe
        5⤵
        
        PID:2468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22183.exe
        6⤵
        
        PID:15332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8409.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16488.exe
        5⤵
        
        PID:14044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3770.exe
        5⤵
        
        PID:10560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29256.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29256.exe
      4⤵
      PID:7636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10158.exe
        5⤵
        
        PID:11156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-589.exe
        5⤵
        
        PID:14488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20305.exe
        5⤵
        
        PID:7100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54275.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54275.exe
      4⤵
      PID:10296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27088.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27088.exe
      4⤵
      PID:12656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52115.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52115.exe
      4⤵
      PID:6524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6252.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6252.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60710.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60710.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30882.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58650.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49626.exe
        7⤵
        
        PID:2828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52698.exe
        8⤵
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47247.exe
        9⤵
        
        PID:8228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13365.exe
        9⤵
        
        PID:11804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19914.exe
        9⤵
        
        PID:6264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48954.exe
        8⤵
        
        PID:8276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53141.exe
        8⤵
        
        PID:11872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59745.exe
        8⤵
        
        PID:3136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34524.exe
        7⤵
        
        PID:6572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55415.exe
        8⤵
        
        PID:7832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25512.exe
        8⤵
        
        PID:12564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34781.exe
        8⤵
        
        PID:15440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18095.exe
        8⤵
        
        PID:16644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6664.exe
        7⤵
        
        PID:6800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12301.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-580.exe
        7⤵
        
        PID:5004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1940.exe
        6⤵
        
        PID:64
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25418.exe
        7⤵
        
        PID:6760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13334.exe
        8⤵
        
        PID:9112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59546.exe
        8⤵
        
        PID:13140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8053.exe
        8⤵
        
        PID:15488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2021.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6436.exe
        7⤵
        
        PID:12992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20537.exe
        7⤵
        
        PID:15224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64211.exe
        7⤵
        
        PID:5768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21591.exe
        6⤵
        
        PID:6860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51191.exe
        7⤵
        
        PID:10944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-589.exe
        7⤵
        
        PID:13752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20305.exe
        7⤵
        
        PID:13980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14797.exe
        6⤵
        
        PID:9972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45785.exe
        6⤵
        
        PID:12364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40337.exe
        6⤵
        
        PID:5196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51961.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22766.exe
        6⤵
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21334.exe
        7⤵
        
        PID:6728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2322.exe
        8⤵
        
        PID:8136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30277.exe
        8⤵
        
        PID:11460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57055.exe
        8⤵
        
        PID:16340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1097.exe
        7⤵
        
        PID:8452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22772.exe
        7⤵
        
        PID:13176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4201.exe
        7⤵
        
        PID:16312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36449.exe
        7⤵
        
        PID:6636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18956.exe
        6⤵
        
        PID:6972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47247.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59826.exe
        7⤵
        
        PID:11964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21768.exe
        7⤵
        
        PID:2952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57055.exe
        7⤵
        
        PID:2744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39145.exe
        6⤵
        
        PID:8640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12301.exe
        6⤵
        
        PID:13032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38016.exe
        5⤵
        
        PID:5704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28106.exe
        6⤵
        
        PID:6564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41679.exe
        7⤵
        
        PID:10832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-589.exe
        7⤵
        
        PID:14376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64211.exe
        7⤵
        
        PID:3512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40697.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3660.exe
        6⤵
        
        PID:4652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3770.exe
        6⤵
        
        PID:16024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30145.exe
        5⤵
        
        PID:7412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37175.exe
        6⤵
        
        PID:14760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-937.exe
        6⤵
        
        PID:3004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10853.exe
        6⤵
        
        PID:2044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36064.exe
        5⤵
        
        PID:10072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58990.exe
        5⤵
        
        PID:13900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63399.exe
        5⤵
        
        PID:928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28888.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28888.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57389.exe
        5⤵
        
        PID:3736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43570.exe
        6⤵
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62623.exe
        7⤵
        
        PID:7288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21363.exe
        8⤵
        
        PID:11480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32557.exe
        8⤵
        
        PID:16308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24081.exe
        7⤵
        
        PID:9608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62321.exe
        7⤵
        
        PID:14968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8053.exe
        7⤵
        
        PID:15472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64330.exe
        6⤵
        
        PID:6692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60349.exe
        6⤵
        
        PID:11492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9631.exe
        6⤵
        
        PID:15456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14087.exe
        5⤵
        
        PID:5416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55415.exe
        6⤵
        
        PID:7760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50506.exe
        6⤵
        
        PID:11708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60386.exe
        5⤵
        
        PID:8056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24300.exe
        5⤵
        
        PID:11824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49337.exe
        5⤵
        
        PID:15748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6782.exe
        5⤵
        
        PID:15752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58611.exe
        5⤵
        
        PID:17228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45276.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45276.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47462.exe
        5⤵
        
        PID:5264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50690.exe
        6⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29863.exe
        7⤵
        
        PID:7920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59546.exe
        7⤵
        
        PID:12300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64211.exe
        7⤵
        
        PID:16576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19125.exe
        6⤵
        
        PID:9516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3660.exe
        6⤵
        
        PID:4988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3770.exe
        6⤵
        
        PID:14280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29044.exe
        5⤵
        
        PID:5752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55275.exe
        6⤵
        
        PID:11044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-589.exe
        6⤵
        
        PID:14608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53938.exe
        6⤵
        
        PID:15704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54817.exe
        5⤵
        
        PID:9236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30330.exe
        5⤵
        
        PID:14280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29004.exe
        5⤵
        
        PID:13824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21924.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21924.exe
      4⤵
      PID:5640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3793.exe
        5⤵
        
        PID:6064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35867.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55462.exe
        6⤵
        
        PID:12476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20305.exe
        6⤵
        
        PID:14508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5285.exe
        5⤵
        
        PID:9436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65305.exe
        5⤵
        
        PID:14256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15739.exe
        5⤵
        
        PID:17384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41708.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41708.exe
      4⤵
      PID:7600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37209.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37209.exe
      4⤵
      PID:10316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42987.exe
        5⤵
        
        PID:15148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10853.exe
        5⤵
        
        PID:1448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32283.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32283.exe
      4⤵
      PID:12100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6338.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6338.exe
      4⤵
      PID:15440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54580.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54580.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3637.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3637.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22626.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18682.exe
        6⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-285.exe
        7⤵
        
        PID:5368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60423.exe
        8⤵
        
        PID:12532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64211.exe
        8⤵
        
        PID:16784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56458.exe
        7⤵
        
        PID:10132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35949.exe
        7⤵
        
        PID:13660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57055.exe
        7⤵
        
        PID:15568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54242.exe
        6⤵
        
        PID:8168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25691.exe
        7⤵
        
        PID:14864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-937.exe
        7⤵
        
        PID:16196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10853.exe
        7⤵
        
        PID:4812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1636.exe
        6⤵
        
        PID:10736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10049.exe
        6⤵
        
        PID:15008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11872.exe
        6⤵
        
        PID:15552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24280.exe
        5⤵
        
        PID:5692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41126.exe
        6⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22411.exe
        7⤵
        
        PID:11020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-589.exe
        7⤵
        
        PID:2000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58214.exe
        7⤵
        
        PID:7164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19509.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52285.exe
        6⤵
        
        PID:13792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57055.exe
        6⤵
        
        PID:6304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36724.exe
        5⤵
        
        PID:7248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56531.exe
        6⤵
        
        PID:12512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54310.exe
        6⤵
        
        PID:16304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15209.exe
        6⤵
        
        PID:16512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28394.exe
        5⤵
        
        PID:9872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9988.exe
        5⤵
        
        PID:13684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7281.exe
        5⤵
        
        PID:2620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47388.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47388.exe
      4⤵
      PID:4872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59434.exe
        5⤵
        
        PID:7048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55415.exe
        6⤵
        
        PID:7504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50506.exe
        6⤵
        
        PID:11716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52971.exe
        6⤵
        
        PID:5232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34693.exe
        5⤵
        
        PID:9188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6436.exe
        5⤵
        
        PID:13064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9101.exe
        5⤵
        
        PID:1136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40861.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40861.exe
      4⤵
      PID:7116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41679.exe
        5⤵
        
        PID:10780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-589.exe
        5⤵
        
        PID:14344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21880.exe
        5⤵
        
        PID:892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40918.exe
        5⤵
        
        PID:15460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30444.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30444.exe
      4⤵
      PID:10228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58798.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58798.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2138.exe
      4⤵
      PID:3952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19708.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19708.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25379.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25379.exe
      4⤵
      PID:5916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4177.exe
        5⤵
        
        PID:5484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48659.exe
        6⤵
        
        PID:14264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16910.exe
        6⤵
        
        PID:2784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53421.exe
        5⤵
        
        PID:10820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20189.exe
        5⤵
        
        PID:14360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36980.exe
        5⤵
        
        PID:7036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50757.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50757.exe
      4⤵
      PID:7208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11938.exe
        5⤵
        
        PID:9404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15389.exe
        5⤵
        
        PID:4052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28665.exe
        5⤵
        
        PID:12308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32172.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32172.exe
      4⤵
      PID:9600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42653.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42653.exe
      4⤵
      PID:13136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44130.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44130.exe
      4⤵
      PID:1532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42284.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42284.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9361.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9361.exe
      4⤵
      PID:4464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25802.exe
        5⤵
        
        PID:6476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55415.exe
        6⤵
        
        PID:7396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62461.exe
        6⤵
        
        PID:12544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15380.exe
        6⤵
        
        PID:15636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26264.exe
        6⤵
        
        PID:16652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38045.exe
        5⤵
        
        PID:8312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6436.exe
        5⤵
        
        PID:13088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8053.exe
        5⤵
        
        PID:15964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15448.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15448.exe
      4⤵
      PID:6080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2706.exe
        5⤵
        
        PID:7844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39811.exe
        6⤵
        
        PID:12640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2909.exe
        6⤵
        
        PID:15432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16718.exe
        6⤵
        
        PID:3696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24849.exe
        5⤵
        
        PID:11296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59745.exe
        5⤵
        
        PID:8100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2004.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2004.exe
      4⤵
      PID:8648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45986.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45986.exe
      4⤵
      PID:12168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15449.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15449.exe
      4⤵
      PID:6652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50585.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50585.exe
    3⤵
    PID:5300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52802.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52802.exe
      4⤵
      PID:6456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46967.exe
        5⤵
        
        PID:9592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55462.exe
        5⤵
        
        PID:12648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61338.exe
        5⤵
        
        PID:15504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61118.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61118.exe
      4⤵
      PID:9672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3660.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3660.exe
      4⤵
      PID:12484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51674.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51674.exe
      4⤵
      PID:15948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34454.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34454.exe
    3⤵
    PID:7236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27242.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27242.exe
      4⤵
      PID:16664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11172.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11172.exe
    3⤵
    PID:9660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32853.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32853.exe
    3⤵
    PID:14024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34298.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34298.exe
    3⤵
    PID:2372
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23216.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23216.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42646.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42646.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11701.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11701.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15121.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41930.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15225.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14213.exe
        8⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27722.exe
        9⤵
        
        PID:6820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63443.exe
        10⤵
        
        PID:10956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-589.exe
        10⤵
        
        PID:14404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20305.exe
        10⤵
        
        PID:6676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44101.exe
        9⤵
        
        PID:10400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64730.exe
        9⤵
        
        PID:14080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33280.exe
        9⤵
        
        PID:15580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6652.exe
        8⤵
        
        PID:7328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1990.exe
        9⤵
        
        PID:11084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-589.exe
        9⤵
        
        PID:14480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54553.exe
        9⤵
        
        PID:15908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64211.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18444.exe
        8⤵
        
        PID:9956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18653.exe
        8⤵
        
        PID:13692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4691.exe
        8⤵
        
        PID:1696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40040.exe
        7⤵
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13209.exe
        8⤵
        
        PID:6864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43023.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:11012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-589.exe
        9⤵
        
        PID:14496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31202.exe
        9⤵
        
        PID:3952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13673.exe
        9⤵
        
        PID:16580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1636.exe
        8⤵
        
        PID:10720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10049.exe
        8⤵
        
        PID:14972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11872.exe
        8⤵
        
        PID:3172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12665.exe
        8⤵
        
        PID:17348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44508.exe
        7⤵
        
        PID:7608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42758.exe
        7⤵
        
        PID:10852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14698.exe
        7⤵
        
        PID:560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32116.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42802.exe
        7⤵
        
        PID:5608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40934.exe
        8⤵
        
        PID:1960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22079.exe
        9⤵
        
        PID:2340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58238.exe
        9⤵
        
        PID:13124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39561.exe
        9⤵
        
        PID:16224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16910.exe
        9⤵
        
        PID:2376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33105.exe
        8⤵
        
        PID:9268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12596.exe
        8⤵
        
        PID:13840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57055.exe
        8⤵
        
        PID:16260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30772.exe
        7⤵
        
        PID:7592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65481.exe
        7⤵
        
        PID:10876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20189.exe
        7⤵
        
        PID:14412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20835.exe
        7⤵
        
        PID:7944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37440.exe
        6⤵
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19554.exe
        7⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14870.exe
        8⤵
        
        PID:10156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46718.exe
        8⤵
        
        PID:13760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64211.exe
        8⤵
        
        PID:2684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32145.exe
        7⤵
        
        PID:9828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3660.exe
        7⤵
        
        PID:12336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38313.exe
        6⤵
        
        PID:7368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15254.exe
        7⤵
        
        PID:9780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55462.exe
        7⤵
        
        PID:2920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64211.exe
        7⤵
        
        PID:2000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19728.exe
        6⤵
        
        PID:9768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58990.exe
        6⤵
        
        PID:13608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41224.exe
        6⤵
        
        PID:16372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51914.exe
        6⤵
        
        PID:5200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46569.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35646.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31894.exe
        7⤵
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45903.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65187.exe
        9⤵
        
        PID:13984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65025.exe
        9⤵
        
        PID:16120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13402.exe
        9⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24081.exe
        8⤵
        
        PID:10504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53577.exe
        8⤵
        
        PID:14616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64211.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14169.exe
        7⤵
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38777.exe
        7⤵
        
        PID:9472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40330.exe
        7⤵
        
        PID:15236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28466.exe
        7⤵
        
        PID:6292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27788.exe
        6⤵
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33267.exe
        7⤵
        
        PID:7364
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7364 -s 636
        8⤵
        Program crash
        
        PID:920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41953.exe
        7⤵
        
        PID:9896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58045.exe
        7⤵
        
        PID:15232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20305.exe
        7⤵
        
        PID:13996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16420.exe
        6⤵
        
        PID:4232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12737.exe
        6⤵
        
        PID:11644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54410.exe
        6⤵
        
        PID:17196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21347.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27618.exe
        6⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53186.exe
        7⤵
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47107.exe
        8⤵
        
        PID:10932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-589.exe
        8⤵
        
        PID:14368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64211.exe
        8⤵
        
        PID:6604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33105.exe
        7⤵
        
        PID:9292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12596.exe
        7⤵
        
        PID:13848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11938.exe
        7⤵
        
        PID:3508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54242.exe
        6⤵
        
        PID:8160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41679.exe
        7⤵
        
        PID:10772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-589.exe
        7⤵
        
        PID:14352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61338.exe
        7⤵
        
        PID:2952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1636.exe
        6⤵
        
        PID:10712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10049.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11872.exe
        6⤵
        
        PID:15576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52433.exe
        5⤵
        
        PID:5728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55415.exe
        6⤵
        
        PID:7324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42337.exe
        6⤵
        
        PID:11616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57055.exe
        6⤵
        
        PID:2712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31108.exe
        5⤵
        
        PID:8340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61343.exe
        5⤵
        
        PID:12764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14314.exe
        5⤵
        
        PID:6532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44073.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44073.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18002.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7633.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20218.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23947.exe
        8⤵
        
        PID:7952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14870.exe
        9⤵
        
        PID:10208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38549.exe
        9⤵
        
        PID:13704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8053.exe
        9⤵
        
        PID:3864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51362.exe
        8⤵
        
        PID:10192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19752.exe
        8⤵
        
        PID:13688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64694.exe
        8⤵
        
        PID:15840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3770.exe
        8⤵
        
        PID:6704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6385.exe
        7⤵
        
        PID:7232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51221.exe
        7⤵
        
        PID:5044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40330.exe
        7⤵
        
        PID:15272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26356.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5446.exe
        7⤵
        
        PID:7516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4324.exe
        7⤵
        
        PID:11892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8583.exe
        7⤵
        
        PID:16300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29824.exe
        6⤵
        
        PID:8360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54922.exe
        6⤵
        
        PID:11920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5477.exe
        6⤵
        
        PID:15624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11557.exe
        6⤵
        
        PID:5468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9724.exe
        5⤵
        
        PID:4908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32086.exe
        6⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62187.exe
        7⤵
        
        PID:8124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65062.exe
        7⤵
        
        PID:12604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16214.exe
        7⤵
        
        PID:6608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20173.exe
        6⤵
        
        PID:8332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44973.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36980.exe
        6⤵
        
        PID:5648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3143.exe
        5⤵
        
        PID:6588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55415.exe
        6⤵
        
        PID:8372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59826.exe
        6⤵
        
        PID:11956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12529.exe
        5⤵
        
        PID:8284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3636.exe
        5⤵
        
        PID:13056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32861.exe
        5⤵
        
        PID:15784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59745.exe
        5⤵
        
        PID:5572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33407.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33407.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1577.exe
        5⤵
        
        PID:3728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20950.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34035.exe
        7⤵
        
        PID:7748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25041.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34464.exe
        7⤵
        
        PID:14884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64211.exe
        7⤵
        
        PID:5556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36701.exe
        6⤵
        
        PID:8212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27100.exe
        6⤵
        
        PID:11840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20835.exe
        6⤵
        
        PID:4392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43460.exe
        5⤵
        
        PID:7008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2322.exe
        6⤵
        
        PID:8108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42041.exe
        6⤵
        
        PID:12468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4499.exe
        6⤵
        
        PID:4168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14832.exe
        5⤵
        
        PID:7204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28638.exe
        5⤵
        
        PID:13188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15739.exe
        5⤵
        
        PID:17376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8904.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8904.exe
      4⤵
      PID:5216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25418.exe
        5⤵
        
        PID:6836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55415.exe
        6⤵
        
        PID:7440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1497.exe
        6⤵
        
        PID:11520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3770.exe
        6⤵
        
        PID:16212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2021.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6436.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22536.exe
        5⤵
        
        PID:15656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57439.exe
        5⤵
        
        PID:7660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6347.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6347.exe
      4⤵
      PID:6908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39183.exe
        5⤵
        
        PID:9376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55462.exe
        5⤵
        
        PID:12636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64211.exe
        5⤵
        
        PID:5564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18185.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18185.exe
      4⤵
      PID:10064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9366.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9366.exe
      4⤵
      PID:13120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18398.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18398.exe
      4⤵
      PID:15564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20424.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20424.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63938.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63938.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22086.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44701.exe
        6⤵
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5638.exe
        7⤵
        
        PID:7400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53822.exe
        7⤵
        
        PID:10536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34464.exe
        7⤵
        
        PID:14928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3969.exe
        7⤵
        
        PID:848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62113.exe
        6⤵
        
        PID:7836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44450.exe
        6⤵
        
        PID:11304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31878.exe
        6⤵
        
        PID:7020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17700.exe
        5⤵
        
        PID:2912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19642.exe
        6⤵
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11450.exe
        7⤵
        
        PID:8300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1778.exe
        8⤵
        
        PID:15896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23875.exe
        8⤵
        
        PID:4468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39405.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44802.exe
        7⤵
        
        PID:5560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44678.exe
        6⤵
        
        PID:8460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36613.exe
        6⤵
        
        PID:12040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63621.exe
        6⤵
        
        PID:2528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45532.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36200.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55415.exe
        6⤵
        
        PID:8256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63613.exe
        6⤵
        
        PID:12780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42930.exe
        6⤵
        
        PID:15528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52971.exe
        6⤵
        
        PID:5408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21081.exe
        5⤵
        
        PID:9024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38088.exe
        5⤵
        
        PID:11852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-329.exe
        5⤵
        
        PID:15924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10114.exe
        5⤵
        
        PID:5328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15588.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15588.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1577.exe
        5⤵
        
        PID:2584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30846.exe
        6⤵
        
        PID:6948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55415.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26001.exe
        7⤵
        
        PID:11568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41832.exe
        7⤵
        
        PID:5192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18357.exe
        6⤵
        
        PID:9136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6436.exe
        6⤵
        
        PID:13152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8245.exe
        6⤵
        
        PID:16272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65033.exe
        5⤵
        
        PID:7068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51186.exe
        6⤵
        
        PID:12920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40918.exe
        6⤵
        
        PID:2488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37521.exe
        5⤵
        
        PID:10096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41814.exe
        5⤵
        
        PID:13816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20835.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16635.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16635.exe
      4⤵
      PID:5360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15779.exe
        5⤵
        
        PID:7972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19775.exe
        6⤵
        
        PID:12324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8053.exe
        6⤵
        
        PID:15828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52706.exe
        5⤵
        
        PID:9440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56509.exe
        5⤵
        
        PID:14736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29412.exe
        5⤵
        
        PID:16372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8583.exe
        5⤵
        
        PID:16316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25986.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25986.exe
      4⤵
      PID:7308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48421.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48421.exe
      4⤵
      PID:6332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15129.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15129.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7473.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7473.exe
      4⤵
      PID:5284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37196.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37196.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30254.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30254.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62262.exe
        5⤵
        
        PID:3756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15557.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58731.exe
        7⤵
        
        PID:7456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22987.exe
        8⤵
        
        PID:10328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46666.exe
        8⤵
        
        PID:14852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14672.exe
        8⤵
        
        PID:15948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15209.exe
        8⤵
        
        PID:16636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4324.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8583.exe
        7⤵
        
        PID:15760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28533.exe
        6⤵
        
        PID:8244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27100.exe
        6⤵
        
        PID:11796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36980.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5936.exe
        5⤵
        
        PID:6468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55415.exe
        6⤵
        
        PID:7820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21725.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57055.exe
        6⤵
        
        PID:4260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51781.exe
        5⤵
        
        PID:8524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12301.exe
        5⤵
        
        PID:13048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16022.exe
        5⤵
        
        PID:6240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9532.exe
      4⤵
      PID:5064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20950.exe
        5⤵
        
        PID:6212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55415.exe
        6⤵
        
        PID:7864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13365.exe
        6⤵
        
        PID:11832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30678.exe
        6⤵
        
        PID:15612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57055.exe
        6⤵
        
        PID:1012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64906.exe
        5⤵
        
        PID:8528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11916.exe
        5⤵
        
        PID:12080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46133.exe
        5⤵
        
        PID:15888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34781.exe
        5⤵
        
        PID:3084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62252.exe
        5⤵
        
        PID:4320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36776.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2322.exe
        5⤵
        
        PID:8120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46614.exe
        5⤵
        
        PID:11552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43401.exe
        5⤵
        
        PID:15616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20697.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20697.exe
      4⤵
      PID:7260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3636.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3636.exe
      4⤵
      PID:13160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59745.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59745.exe
      4⤵
      PID:15396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39273.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39273.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9553.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9553.exe
      4⤵
      PID:3664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12973.exe
        5⤵
        
        PID:6852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55415.exe
        6⤵
        
        PID:5772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58377.exe
        6⤵
        
        PID:12488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29178.exe
        6⤵
        
        PID:16264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18357.exe
        5⤵
        
        PID:9076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6436.exe
        5⤵
        
        PID:13080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1077.exe
        5⤵
        
        PID:15500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45002.exe
        5⤵
        
        PID:5540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65033.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65033.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37521.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37521.exe
      4⤵
      PID:10088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41814.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41814.exe
      4⤵
      PID:13644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8775.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8775.exe
      4⤵
      PID:16152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13835.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13835.exe
    3⤵
    PID:5340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24214.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24214.exe
      4⤵
      PID:6232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2322.exe
        5⤵
        
        PID:6388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46090.exe
        5⤵
        
        PID:13432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45532.exe
        5⤵
        
        PID:2940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1097.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1097.exe
      4⤵
      PID:7276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22004.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22004.exe
      4⤵
      PID:12928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51866.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51866.exe
      4⤵
      PID:1136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3770.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3770.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5136.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5136.exe
    3⤵
    PID:7184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48363.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48363.exe
      4⤵
      PID:12316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8053.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8053.exe
      4⤵
      PID:14720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40871.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40871.exe
    3⤵
    PID:9540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38188.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38188.exe
    3⤵
    PID:2272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44139.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44139.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:13248
- C:\Users\Admin\AppData\Local\Temp\Unicorn-65104.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-65104.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60710.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60710.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51613.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51613.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28438.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51821.exe
        6⤵
        
        PID:6932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14486.exe
        7⤵
        
        PID:9480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55462.exe
        7⤵
        
        PID:12524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8053.exe
        7⤵
        
        PID:3896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35985.exe
        6⤵
        
        PID:7688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13609.exe
        6⤵
        
        PID:12360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59745.exe
        6⤵
        
        PID:5548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54369.exe
        5⤵
        
        PID:6184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11450.exe
        6⤵
        
        PID:8384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55742.exe
        6⤵
        
        PID:11976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57055.exe
        6⤵
        
        PID:15428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13104.exe
        5⤵
        
        PID:8540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17781.exe
        5⤵
        
        PID:12088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15449.exe
        5⤵
        
        PID:6560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18031.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18031.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16134.exe
        5⤵
        
        PID:5324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1362.exe
        6⤵
        
        PID:7692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18691.exe
        7⤵
        
        PID:15704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10853.exe
        7⤵
        
        PID:3076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4324.exe
        6⤵
        
        PID:11764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25530.exe
        6⤵
        
        PID:15912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4499.exe
        6⤵
        
        PID:728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40785.exe
        5⤵
        
        PID:8112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27100.exe
        5⤵
        
        PID:11816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61868.exe
        5⤵
        
        PID:5204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41105.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41105.exe
      4⤵
      PID:6256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59307.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62461.exe
        5⤵
        
        PID:12552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3329.exe
        5⤵
        
        PID:16180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20451.exe
        5⤵
        
        PID:7104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64741.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64741.exe
      4⤵
      PID:8644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20785.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20785.exe
      4⤵
      PID:12176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51454.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51454.exe
      4⤵
      PID:212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4192.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4192.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21702.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21702.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1577.exe
        5⤵
        
        PID:1616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61406.exe
        6⤵
        
        PID:6316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47247.exe
        7⤵
        
        PID:8264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63613.exe
        7⤵
        
        PID:12788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52971.exe
        7⤵
        
        PID:4600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1481.exe
        6⤵
        
        PID:9032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40889.exe
        6⤵
        
        PID:11812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59745.exe
        6⤵
        
        PID:1264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18956.exe
        5⤵
        
        PID:6980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55415.exe
        6⤵
        
        PID:7812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25512.exe
        6⤵
        
        PID:12572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37346.exe
        6⤵
        
        PID:16196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59128.exe
        6⤵
        
        PID:16596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30976.exe
        5⤵
        
        PID:7428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12301.exe
        5⤵
        
        PID:13004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8583.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42780.exe
      4⤵
      PID:5136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19671.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19671.exe
      4⤵
      PID:6460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2322.exe
        5⤵
        
        PID:8088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30277.exe
        5⤵
        
        PID:11452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14341.exe
        5⤵
        
        PID:15512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57646.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57646.exe
      4⤵
      PID:8048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3636.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3636.exe
      4⤵
      PID:13024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59745.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59745.exe
      4⤵
      PID:5544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-159.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-159.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33756.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33756.exe
      4⤵
      PID:6276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10490.exe
        5⤵
        
        PID:8132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63142.exe
        5⤵
        
        PID:11368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34781.exe
        5⤵
        
        PID:15224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37748.exe
        5⤵
        
        PID:5944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30400.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30400.exe
      4⤵
      PID:8752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35078.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35078.exe
      4⤵
      PID:12224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64842.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64842.exe
      4⤵
      PID:4876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47389.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47389.exe
    3⤵
    PID:4624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19554.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19554.exe
      4⤵
      PID:6012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34051.exe
        5⤵
        
        PID:14600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45565.exe
        5⤵
        
        PID:5108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7641.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7641.exe
      4⤵
      PID:9804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3660.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3660.exe
      4⤵
      PID:12440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32550.exe
      4⤵
      PID:15892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25755.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25755.exe
    3⤵
    PID:5700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42027.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42027.exe
      4⤵
      PID:14816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-937.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-937.exe
      4⤵
      PID:15376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23875.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23875.exe
      4⤵
      PID:6124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19721.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19721.exe
    3⤵
    PID:9588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59719.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59719.exe
    3⤵
    PID:13772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12304.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12304.exe
    3⤵
    PID:15460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10422.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10422.exe
    3⤵
    PID:16120
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60445.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60445.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65090.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65090.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26902.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26902.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2153.exe
        5⤵
        
        PID:5460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19362.exe
        6⤵
        
        PID:7132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37699.exe
        7⤵
        
        PID:11608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33174.exe
        7⤵
        
        PID:2784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5017.exe
        7⤵
        
        PID:1844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3068.exe
        6⤵
        
        PID:10468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64730.exe
        6⤵
        
        PID:13612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1375.exe
        6⤵
        
        PID:536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6652.exe
        5⤵
        
        PID:6376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18327.exe
        6⤵
        
        PID:11032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-589.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8437.exe
        6⤵
        
        PID:16208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34972.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2317.exe
        5⤵
        
        PID:13988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20835.exe
        5⤵
        
        PID:6672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15536.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15536.exe
      4⤵
      PID:6084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27722.exe
        5⤵
        
        PID:6804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22411.exe
        6⤵
        
        PID:10980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-589.exe
        6⤵
        
        PID:14428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8053.exe
        6⤵
        
        PID:4144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28061.exe
        5⤵
        
        PID:9856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3660.exe
        5⤵
        
        PID:12540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57055.exe
        5⤵
        
        PID:2768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28555.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28555.exe
      4⤵
      PID:5628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2618.exe
        5⤵
        
        PID:10172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46718.exe
        5⤵
        
        PID:13728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8053.exe
        5⤵
        
        PID:3888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49006.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49006.exe
      4⤵
      PID:9532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59189.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59189.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24001.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24001.exe
      4⤵
      PID:3652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31348.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31348.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2153.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2153.exe
      4⤵
      PID:5452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27338.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13526.exe
        6⤵
        
        PID:7224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63630.exe
        6⤵
        
        PID:4864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61338.exe
        6⤵
        
        PID:4020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48866.exe
        5⤵
        
        PID:9620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3660.exe
        5⤵
        
        PID:12448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57055.exe
        5⤵
        
        PID:16132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9776.exe
      4⤵
      PID:6452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54367.exe
        5⤵
        
        PID:2176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55462.exe
        5⤵
        
        PID:12508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64211.exe
        5⤵
        
        PID:5212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21760.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21760.exe
      4⤵
      PID:9280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54834.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54834.exe
      4⤵
      PID:12312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45532.exe
      4⤵
      PID:2688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41524.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41524.exe
    3⤵
    PID:6132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62623.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62623.exe
      4⤵
      PID:6904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39479.exe
        5⤵
        
        PID:14288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19021.exe
        5⤵
        
        PID:6648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11829.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11829.exe
      4⤵
      PID:9880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58969.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58969.exe
      4⤵
      PID:14704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8583.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8583.exe
      4⤵
      PID:1752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22286.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22286.exe
    3⤵
    PID:7540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4072.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4072.exe
    3⤵
    PID:11652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47254.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47254.exe
    3⤵
    PID:6208
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11043.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11043.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6289.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6289.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14213.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14213.exe
      4⤵
      PID:5592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24214.exe
        5⤵
        
        PID:6428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63583.exe
        6⤵
        
        PID:7384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62950.exe
        6⤵
        
        PID:11540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43401.exe
        6⤵
        
        PID:15540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12826.exe
        6⤵
        
        PID:2472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2021.exe
        5⤵
        
        PID:9080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6436.exe
        5⤵
        
        PID:13072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57055.exe
        5⤵
        
        PID:16224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18904.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18904.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29723.exe
        5⤵
        
        PID:11408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57055.exe
        5⤵
        
        PID:2236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34972.exe
      4⤵
      PID:9836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2317.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2317.exe
      4⤵
      PID:13716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59745.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59745.exe
      4⤵
      PID:16736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43792.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43792.exe
    3⤵
    PID:6744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55415.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55415.exe
      4⤵
      PID:7388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58674.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58674.exe
      4⤵
      PID:11672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43401.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43401.exe
      4⤵
      PID:15628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57055.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57055.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37958.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37958.exe
    3⤵
    PID:9160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3636.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3636.exe
    3⤵
    PID:13144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64958.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64958.exe
    3⤵
    PID:1984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20835.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20835.exe
    3⤵
    PID:6168
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25748.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25748.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63606.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63606.exe
    3⤵
    PID:5436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44442.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44442.exe
      4⤵
      PID:6616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18135.exe
        5⤵
        
        PID:9260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1933.exe
        5⤵
        
        PID:12836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58214.exe
        5⤵
        
        PID:7160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61118.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61118.exe
      4⤵
      PID:9664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3660.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3660.exe
      4⤵
      PID:12340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3770.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3770.exe
      4⤵
      PID:13324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18904.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18904.exe
    3⤵
    PID:6100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30735.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30735.exe
      4⤵
      PID:15188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10853.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10853.exe
      4⤵
      PID:15620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34972.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34972.exe
    3⤵
    PID:9652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2317.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2317.exe
    3⤵
    PID:13996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20835.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20835.exe
    3⤵
    PID:768
- C:\Users\Admin\AppData\Local\Temp\Unicorn-2497.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-2497.exe
  2⤵
  PID:5976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5137.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5137.exe
    3⤵
    PID:6164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22795.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22795.exe
      4⤵
      PID:10756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2317.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2317.exe
      4⤵
      PID:15312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28971.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28971.exe
      4⤵
      PID:6612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21324.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21324.exe
    3⤵
    PID:9476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21533.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21533.exe
    3⤵
    PID:13976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14996.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14996.exe
    3⤵
    PID:15808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1917.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1917.exe
    3⤵
    PID:1632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8967.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8967.exe
    3⤵
    PID:6420
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37043.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37043.exe
  2⤵
  PID:7680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46059.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46059.exe
    3⤵
    PID:11420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24766.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24766.exe
    3⤵
    PID:5240
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51913.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51913.exe
  2⤵
  PID:10348
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25953.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25953.exe
  2⤵
  PID:12308
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32787.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32787.exe
  2⤵
  PID:6832

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:7280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 7364 -ip 7364
1⤵
PID:8768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-108.exe

Filesize
468KB

MD5
ce295517b517febbdf01b34b376e0d51

SHA1
290d604c8156a1a7aabc52592dc914380e15e4d5

SHA256
4e1d12b983609db6c8102ec4438b3be1a3fa2f2e431d04bcf5d767d9e0a878e5

SHA512
e8eff70aa9419b737703141513831ce0d6e83708919b7d1949e68121e04517295dd8c412c9b24745162cfeea345f23fe82540c1cc7cdb1a4ee3d8dd41a1387e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11043.exe

Filesize
468KB

MD5
c15df8d4270b9fe268c999accccb58e3

SHA1
763a0e7bce84fe75223d431cc6e17df42b12a8f3

SHA256
e0bfa2771fab50ebc14caaae598e66e6ec9a7befa64c58849443f2ace0bb4eb4

SHA512
173388784ab2ed6401e7d5d44e1835e0fac4066603dfb00c15aabb144ad719c9ed2ee2c295e4bb527ad6306027624bfc43000c64b70a0df8c59c7ce4952d679e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11701.exe

Filesize
468KB

MD5
970bc617f05db0ced740c6b3976f2673

SHA1
6788003afa981baa2546883af43813383f5e58b9

SHA256
de92993b31b2cc6ff14e9819403650979df0c581cab9233c07c8ffc7adc260ac

SHA512
3bca6d8c64561877020c94e9d4ae35e3d27ed0ba45dcd1d2dc3b44c11ff614a43463754637c6d88badb6e6c37a7055bf741ae16ffd6c6a62a5aaaf922d4cbdff

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12225.exe

Filesize
468KB

MD5
07d6b63540273bd13f1f01b719eaf033

SHA1
c0382006be0ddd85c5889ffec4f80347513b1d7c

SHA256
3bcc81a86ec1e6e39cb0cca25d3a9fbd2265e6805e2a7a8d8aa2336a49dd0b9d

SHA512
2ae4b8920375eb02a8354a465bd5afb3d44440f6d8874ccc8c343e62e1f7a2dff24cfae1ed220ffcc3f57ec4af227d64256de6039cb1d7ffabf7247ed1f0db14

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13209.exe

Filesize
468KB

MD5
f32acd8140b223c62cc4a111272a2296

SHA1
dda66977da069d2a0ceb19a655d95b982f7670d5

SHA256
1103aad4787039004c1924c918074604aaf27862a766f4f72a219640ea1f557e

SHA512
e4181698042b8ec210be6c207b75264f37311f3e6f5a240c21fb17166308bf7a2f21047798924737fc4f7ad097709b3b6f1f89639f7cf6506940c865ce6c48d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13843.exe

Filesize
468KB

MD5
fb2348a6acb476e4d3c60a17b9f7aaef

SHA1
fb57fe51eeec92d53293fa3a7aaa1af7be873ad4

SHA256
339b354c143330bb9dd3a56641ba479684628fe9f2ccff8b2a95854290c2cd35

SHA512
55b16bf28ab3f2db2fe791dc7ac99df5faaf2b3412d3ae8f0cfbc4cc9037dd27961e46c62342d998d27f518aefc2e9a748dab6c22b9682c5a9bf6cc10211bf48

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15121.exe

Filesize
468KB

MD5
4cb49a9a36ddbc261aa3802b8deafa7e

SHA1
fbb3bf99ee0abd8b90ad7d0d62ff5cee28592e51

SHA256
33b07818ea2f62720a3e00f6904a434792493abd168475c3a2d7f675200a7a65

SHA512
6a622c419ae37ca5cc9fa67e41b8b72e885ebe8e66296e8fe23490c8c556bb2003d98653015a5b91271e98293236ee944bca0956cbeaef7371e2658bfb5e5e11

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15890.exe

Filesize
468KB

MD5
1695a643ba585a070207d6812647cae2

SHA1
03b0f84ad454c0d609ad60ba26fc3551b8134783

SHA256
30108d9fd001d1484b3ce6bda36f21757912896e54c8e76dce638faa6e9344c2

SHA512
f859cb7b1723b26cd2079c8691b0f2b8dd8e5d7f08016cb1c7c42d5e03b5ba8b4b98e10b2d67f55a5bf4b20d748a8c6a46a0bb9cc8582ecfb85c453017d9fd39

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19708.exe

Filesize
468KB

MD5
d976288b565105876e95d63e27ebd027

SHA1
315ccc11b1e579f3591fc8abaf7208bfd78523db

SHA256
280d3a4eecc642ecb919f75bc7d3a75737b89d33d61bb15b9b8892a283cf3743

SHA512
bb09565b3aeed75d2fafe961fe923b9f1d962541cc07265f541967231a1672c32c3045000d37e372e911711b24aed6767f1ee1ad1d58a638165f19dc0208452c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20424.exe

Filesize
468KB

MD5
f956b66ffe91b4573857e53631747d82

SHA1
734422b16515fe0fb0fad4da8afa989f40593662

SHA256
deed16bc553da4ecab2351811cec1505c2e62efe875aab43560e6d826dc73d86

SHA512
d4eb4af6addd7cacb8b11fd13430d04d2527b53ba7e2a9a76d0aee6c5592a188c67febb72fccba0708d5c8738f308782378737e199399c07ccb42832c8c97363

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23216.exe

Filesize
468KB

MD5
1647bcf681fbd9a571ed028dce52e175

SHA1
a86e3fefc97c9747222917c875758ba162666b3d

SHA256
b6943823e37133522bc53b23d3bbcbdb646ea6f2eb7f823a85a31995d5275aef

SHA512
0cb49b9610d0f535dbbdcc597143519584a43c5f57abd1e010b2d4c0bd804dc396f9aa1fd73e2a97c4c2f15f81c6807b31b5bea5722b1832712ad3b40d2b056d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26118.exe

Filesize
468KB

MD5
574409e6632a7338d929abe265bb41d2

SHA1
d02bf20d096c5881c3ac91c2ea57c6f981999f53

SHA256
72e60fdc9646966e8408a03268c7be825d19a64ae9d7eb6b4fbba209d06dea26

SHA512
d28c854106c623b0247bfeeff44b28f24e9495eca7fa9f6c53c795c8c01ef6f5a7d19dd3307a7ce4438d0f83964e7aa9a588e5cf511b4bd98acad5e5e8222072

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28888.exe

Filesize
468KB

MD5
308206198b76885458bd25adfbce6f83

SHA1
6aedc33a9b9eaf88c8beacdec625ce0e37fd1bc5

SHA256
e166cdc9c58316a9df53d6557965f6dbf57bd5482fac24756cbee6b728d114ae

SHA512
28e6163141356695c235d664d3e227c809edcdb9e1f8b25b33085780f9c7ec06e110abed82d8254018df3f81221f13e14b2ce4bdd44a3b1671f7a3ef428bba44

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30882.exe

Filesize
468KB

MD5
6d3af3e268af5447db0bc24e3ba594a2

SHA1
1f3af8afea2edb1f1a6c86eed91157a6de79d8c9

SHA256
da4cc06c0612144b8a85e1382ffcf0b7bde9cb7f6d9cbfeb8b6549095a75234c

SHA512
fec74fa408f2ce363cfd85e1b4f5cb1dcad9dfb5dab8d38cf5aafe843171226acfe571f07c220e97b66b4828e63b985b595ee39596ffd886ba3d752ee5e9ac81

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3637.exe

Filesize
468KB

MD5
d511d42ab81dab01dbd57f7e60002dc7

SHA1
37ee7bbc66469a6544b29f02ad9f1bbb893eb637

SHA256
6ffabf4b80db6fe2d043e2b86a0568bee16841055e333ba58636065904cbb939

SHA512
d509800fedf8a22879703ad1441ff4ef964e4b4fd406d164c7cb27244738eebc8cf6247916acd88c0895e3c357b46a0b1b8a2db9167c5207518a39c5302b958c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37196.exe

Filesize
468KB

MD5
b3ec76236977af1cd858218d0d5cb18f

SHA1
2f5ffe46598e78e263d10c967bb9ea8796d493ac

SHA256
29a3e69cd158828f0cfdbc825a505651e6471fc59c38e9b4c7a30dd3db2dd6aa

SHA512
492a1b6a5d448f42e0431f1ac92a71413aafab29cc36cde49ad51651eaa7e6cbea556ab5c1efea1aafd86de6383652167b53c740d93bcad00ecde7ac9730e935

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40844.exe

Filesize
468KB

MD5
24491946f6ef772288372ad865f709be

SHA1
4aafce0f1d7dec97c3fa6d3229ee6db6886ef5d4

SHA256
100f4054b58bf26713a9ff0ce538c3c1d50ce7f0dc9648fbe6dc3e2101ad28ec

SHA512
b1dda5ae8f1c9dc22c3d450747eaea10376f7791bb60b87463db330001d97ac7f5f51eea31335209cd687c17ac9a6a6da9c0e5ecfa5a4a45421ab25d981261b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4192.exe

Filesize
468KB

MD5
07745187d69575c37df6c50ed56c1ed5

SHA1
4a40bb450bcfc1ebe1fae2946f1e62c72f7a9413

SHA256
b4336d4e70ce21337c88c9cc93a6140e8acf1318e288577b947cec29d2a272f2

SHA512
8120d5450cbc97e8e6aa1fa651fbbd05b5d24b8c9ed43d74f6743c57d708f424caa3499715fe3f61c576a6703c9b6383812cef7bc3ab7204866b67c29dacde72

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41930.exe

Filesize
468KB

MD5
ff1eff49e36d66bcd46be3089b40af6f

SHA1
9fc304c07fc165dfbe2c9ad61823d529f104e47b

SHA256
ed29815226e4d7d95a1b4ab271bc6859a5dada28970d8a3e69c502244bfc01c9

SHA512
63f736d166bfe659fa504e77f6274d317224d1187ea02719f49f7761898a8cf8a176aa3cec6e3eb3dd8a9035293e1404a6fe22a26dd9225d1f093b4476de75e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42646.exe

Filesize
468KB

MD5
9a8788d7cd38fbf14996f1679101f3ea

SHA1
b416e1d22ed2d03563b96e6131c65bfdff587cab

SHA256
9587148754b4b100ad68eefe32a1a2136a191c20e5311f64d5895b1e05db0146

SHA512
2b24e8959f04a9e458b46d56376f5bdb643067904f50abb32e13da7b70a1c8d53bb0a3907cc864c8a2541a49f6f5e03b65eebbe809e9ab56f65d011b94ad3463

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43082.exe

Filesize
468KB

MD5
3a213582db370469df72a95b54b4bb57

SHA1
7c90268e4749ee150db1664c36991a5b48571bf3

SHA256
31c14288f38816ee89661385dba9f093183ecccf76916a83f80adbebc226e1f3

SHA512
39cc94d9394613c365031ce61975d8e5635db3180473b380059d7f21baf60870c29a3b1dcc51fa5ed9c1414e083e168ab40bfd3f610fecc27217d02d56687acf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44073.exe

Filesize
468KB

MD5
484f05cae68a8fca30087fa45538cc90

SHA1
35782709a369f5077790f26bc5a1fd21f572c2bb

SHA256
1db363d2991141b39389145b935ac1a788bdad8f841d65f50f55dbdb45515a17

SHA512
9a5bf9beca1fe53c83eb40cea7e4a04d3d800db6f8b20fb513bbe3681ac715cfcd93e450a60796afc29863510558227855b23b5ef6109625b9a77f34ab4f7897

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46569.exe

Filesize
468KB

MD5
072d966f1384fa224927e0cabed3f56b

SHA1
e3f59e90577eea21e27070c20f018e8909714457

SHA256
d87d6c76a4d92cbd8b54692b0ef89106dc7f6323e97bc5639db6e532fb542b4b

SHA512
8b868e92fad6f5f5a64a1e75aa1594b5a3cb7aff12b82bdc5c6fbee6f0c1ab22b68340756c770b64c37a37e04b5a70eaae3d779abbded1becfa99cbc6a82c59d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47529.exe

Filesize
468KB

MD5
3db2a151eb8e08fbca9721a7da641836

SHA1
4cd3f9c4e904bb1ecbf7022094acc3b7f76be1a7

SHA256
4d97c77ed00f78464b4621850d199347d8f29969c361e2a6702a561ad5fb6503

SHA512
acceec626e0d9f910b334071f37adf588e3cb8ce563d1a5d2f2ce08f20fef44bb4fb0bcb85333b123bcab19c1d7636464e9d92095f1bbe7ad2d8b733cd767458

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51613.exe

Filesize
468KB

MD5
b79bda149ad765729ad76ebef240a2af

SHA1
89ce993fff1fa98414a5b1618151fda89510c7dd

SHA256
872de1c6365093db42511f5dc2e009d0fe1539019553cbca8c6fae985a568517

SHA512
b714948281dd7a75c8140f478d0c676a9ae3d9c715ba4c7cae71fd2d75a92560c46492afde8c87bffc8a30380eb11a1171bbc1ce4bc6842d069fbc0900c1eeb1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54580.exe

Filesize
468KB

MD5
088b5921bde4e50e284e791f5adb0fa0

SHA1
6a1c4230c96512b8b74397dc5bfbf87e00cfec0f

SHA256
eee0e0fc9861009ebfdcefa3e3567795a5b0db3e20557dbf706c643c338f1020

SHA512
d9e653b6c56a9dc53f63ae23f3f680dbf954977737426335574ce13380dc03516019b1077712e6bdcf301f485f9dbb375162c1a1caada2c08159d0720f1973c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60445.exe

Filesize
468KB

MD5
8a0ac4001c8dee0dbb1df85ecc09dba2

SHA1
1b4a64eb2bdfdd7a0020b1064a73c5696c66004a

SHA256
08e99644be368df2c2c919ea68d2d6d2536b24c9234227d2fa3a1ddffa9c10d3

SHA512
ee7129c5f947b0af67f2dede9a5e8c73472389289717f6813e0ec424b13982e58b4ea923da27a8927bfa1af24fcde8f532f21e137c24e4e891f36d855c2cee84

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60710.exe

Filesize
468KB

MD5
2d4144239629baf847ad796b49bff3e4

SHA1
fc28b7ad4c4b3eb165f49aee370705e9e2bf0ca2

SHA256
c41c53dc59e318916d0e54cbbfa73cba5a75701871ee9e50237a7b14dce2d5c6

SHA512
5fb977b1fe4fceafa28eb49ea770e6980f254ff2342ad5077e8002da8613ce64ad3f174ce7ce779ae0d5a9161dd5be35c66fcff2bc32c6a31f536ae8c7e25311

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6252.exe

Filesize
468KB

MD5
2e6f6f783372056f8db08548a72e8cd4

SHA1
792a5ec0fb76a207b98b3744a0e0eaad37edaaf4

SHA256
13399412513d562edf2ea084a676f95a6095f6adc58107df7c009c60d62631df

SHA512
af426cd8cbde10353632fa0c99b220881af619a78d43e7edeb11821f7ad6b39f9af831cc68c0b9ee1a7ac26e5ea11df322c7e8907c170d80fa052c37ad7e7a16

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63938.exe

Filesize
468KB

MD5
000d86778bf85cd2d5fe82e1d9a62311

SHA1
a7f6b9625158939f016ca9ae5c472ee7f848f0ef

SHA256
30c7da4021c60c187c2a7909f6e11b6f3010d3c6b327549f822511da42e1e492

SHA512
dac94717129c7a7cb09224e296e66cb140e51ba05a5d1d0b55f2a9e4c09159d7a0c8ed625078c44470bb6be7d04556e7eaa87a5a30b501b4300ddf17f8488d54

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-65090.exe

Filesize
468KB

MD5
73da785bd3b28862f971588f12e1e79b

SHA1
e26d3d176b3c70ab2cb4cb21abce34b2eb87719b

SHA256
ac37f446d76a738f6d5c8434d988d668d72d56dbd92dcf9ff601bbc352d3b2ae

SHA512
a2c5bc682ca300c8fd6afe5711e2c98068209e75ddfcf672fcca9d7b1a6576fb3771fda52f5b1279224dff5dbe83d50dc530a9e9bfc84d967d1647ab334dbc0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-65104.exe

Filesize
468KB

MD5
8ae4cda76b24d12bcb219d8350a9a230

SHA1
eef4dd2e09232f517760c6305cb6743369abaab7

SHA256
59c4d43327a33a7d97b592d560381e76e9ed4857883e744a3b893a7e936938a1

SHA512
36c9e6820d6969fa667e0467a6758dbb327cfe673b2f42f4dc93d887ac17e54fd81c7684c992fb620c184438c9e7fd477eed93c25adb9798dc46177fc0daeb56

Download Submit
memory/64-457-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/220-368-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/412-257-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/456-180-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/556-334-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/644-97-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/688-234-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/832-20-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1180-350-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1184-84-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1192-114-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1412-63-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1444-175-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1476-291-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1492-338-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1516-124-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1536-339-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1556-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1616-436-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1632-3227-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1660-235-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1776-239-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1856-270-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1900-351-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2108-181-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2220-173-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2368-313-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2412-218-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2540-347-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2596-178-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2660-55-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2752-332-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2780-260-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2828-412-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2864-177-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2892-437-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2912-410-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2936-83-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2956-259-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2992-45-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3004-2924-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3108-352-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3284-91-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3316-282-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3412-136-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3448-21-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3464-411-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3488-378-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3664-456-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3708-133-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3724-116-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3736-381-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3756-409-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3764-307-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3924-324-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3940-317-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3952-3226-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4056-179-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4064-246-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4180-258-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4188-340-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4212-210-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4236-353-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4424-87-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4464-475-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4508-204-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4512-33-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4516-225-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4564-369-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4576-379-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4612-103-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4688-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4844-380-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4872-423-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4908-408-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4928-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5000-337-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5064-413-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5068-46-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5096-182-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5136-458-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5160-463-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5216-476-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5264-490-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5300-507-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5316-544-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5340-546-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5352-547-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5360-550-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5380-551-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5388-552-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5452-553-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5460-554-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5584-555-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5592-570-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5608-590-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5692-591-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5716-592-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5776-593-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/12308-3225-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14704-2502-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15224-2925-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15460-2685-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15512-2676-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15656-3212-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads