b123fff245c1bf1871f4e8e61f2eda094e8a17f3427d1222c5ee7cdcad95d7fe

Analysis

max time kernel
120s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/09/2024, 05:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a0066df62b75de9b50da22cbd62947c0N.exe
Size

468KB
MD5

a0066df62b75de9b50da22cbd62947c0
SHA1

f6ee42e00af3301a5d2137e254838ca6c8edebe6
SHA256

b123fff245c1bf1871f4e8e61f2eda094e8a17f3427d1222c5ee7cdcad95d7fe
SHA512

1571046f2a99373125b59fd328e200f76d28493c01607fd06930c46bae763f50dd86f087a5f4d0575d4126f600e5ebb12fc59dd7c30d456e4dbd70cab9ac7cbc
SSDEEP

3072:uqoKogLNjY8U2bx2PzqAff5eChjWIpBImHevVp8wY2Y3hh9IJIlA:uqVo41U2oPeAffG0MkwY2GL9IJ

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1568	Unicorn-36989.exe
2476	Unicorn-53320.exe
2192	Unicorn-34523.exe
2800	Unicorn-23056.exe
3384	Unicorn-53268.exe
424	Unicorn-7596.exe
2196	Unicorn-42307.exe
3688	Unicorn-15869.exe
2448	Unicorn-19438.exe
3440	Unicorn-23845.exe
964	Unicorn-23845.exe
2620	Unicorn-15677.exe
1472	Unicorn-17331.exe
2392	Unicorn-63268.exe
3020	Unicorn-11466.exe
1448	Unicorn-9615.exe
4312	Unicorn-13979.exe
5104	Unicorn-295.exe
3116	Unicorn-30210.exe
1272	Unicorn-36341.exe
2672	Unicorn-56247.exe
2760	Unicorn-10575.exe
3000	Unicorn-26725.exe
3800	Unicorn-16859.exe
3108	Unicorn-36725.exe
3760	Unicorn-36725.exe
4988	Unicorn-36725.exe
4732	Unicorn-5898.exe
388	Unicorn-51727.exe
1328	Unicorn-15598.exe
3104	Unicorn-14908.exe
4728	Unicorn-44244.exe
2860	Unicorn-5095.exe
4200	Unicorn-48166.exe
1616	Unicorn-48567.exe
4516	Unicorn-61608.exe
1656	Unicorn-30581.exe
3532	Unicorn-9454.exe
3648	Unicorn-15021.exe
4332	Unicorn-4732.exe
3456	Unicorn-53476.exe
3144	Unicorn-28552.exe
1268	Unicorn-54125.exe
2212	Unicorn-9074.exe
5012	Unicorn-11675.exe
1796	Unicorn-31541.exe
804	Unicorn-6543.exe
640	Unicorn-413.exe
4536	Unicorn-31048.exe
2696	Unicorn-52215.exe
4852	Unicorn-47384.exe
4828	Unicorn-2822.exe
5052	Unicorn-22423.exe
2032	Unicorn-6351.exe
4288	Unicorn-47192.exe
1944	Unicorn-12797.exe
1968	Unicorn-5391.exe
1764	Unicorn-45846.exe
3520	Unicorn-62412.exe
4360	Unicorn-16741.exe
5008	Unicorn-16741.exe
4304	Unicorn-37907.exe
5116	Unicorn-1373.exe
3632	Unicorn-62412.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
13016	7228	WerFault.exe	315

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63268.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17210.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61434.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15869.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31048.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61316.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27743.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23088.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5016.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5011.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54063.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28954.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9353.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24328.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57599.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41345.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17498.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-433.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61316.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51140.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11023.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17039.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29609.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46817.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43641.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5126.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11761.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31541.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42975.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45395.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23088.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9353.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31912.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34927.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28552.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50283.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63900.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25218.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41071.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8176.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4504.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20409.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38679.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20377.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50572.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54315.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28954.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21575.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9353.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30581.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54436.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6774.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38488.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18690.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54464.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60281.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37490.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50283.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36551.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8690.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64009.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4858.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46296.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	15800	dwm.exe
Token: SeChangeNotifyPrivilege	15800	dwm.exe
Token: 33	15800	dwm.exe
Token: SeIncBasePriorityPrivilege	15800	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
880	a0066df62b75de9b50da22cbd62947c0N.exe
1568	Unicorn-36989.exe
2476	Unicorn-53320.exe
2192	Unicorn-34523.exe
424	Unicorn-7596.exe
3384	Unicorn-53268.exe
2800	Unicorn-23056.exe
2196	Unicorn-42307.exe
3688	Unicorn-15869.exe
3440	Unicorn-23845.exe
2448	Unicorn-19438.exe
964	Unicorn-23845.exe
2620	Unicorn-15677.exe
1472	Unicorn-17331.exe
2392	Unicorn-63268.exe
3020	Unicorn-11466.exe
1448	Unicorn-9615.exe
4312	Unicorn-13979.exe
5104	Unicorn-295.exe
3116	Unicorn-30210.exe
1272	Unicorn-36341.exe
2672	Unicorn-56247.exe
2760	Unicorn-10575.exe
1328	Unicorn-15598.exe
3800	Unicorn-16859.exe
4732	Unicorn-5898.exe
4988	Unicorn-36725.exe
3760	Unicorn-36725.exe
3108	Unicorn-36725.exe
3000	Unicorn-26725.exe
388	Unicorn-51727.exe
3104	Unicorn-14908.exe
4728	Unicorn-44244.exe
4200	Unicorn-48166.exe
2860	Unicorn-5095.exe
1616	Unicorn-48567.exe
4516	Unicorn-61608.exe
1656	Unicorn-30581.exe
3532	Unicorn-9454.exe
3648	Unicorn-15021.exe
4332	Unicorn-4732.exe
3456	Unicorn-53476.exe
3144	Unicorn-28552.exe
1268	Unicorn-54125.exe
5012	Unicorn-11675.exe
1796	Unicorn-31541.exe
2212	Unicorn-9074.exe
804	Unicorn-6543.exe
2696	Unicorn-52215.exe
4852	Unicorn-47384.exe
4536	Unicorn-31048.exe
4828	Unicorn-2822.exe
2032	Unicorn-6351.exe
640	Unicorn-413.exe
4288	Unicorn-47192.exe
5052	Unicorn-22423.exe
1968	Unicorn-5391.exe
1944	Unicorn-12797.exe
1764	Unicorn-45846.exe
2684	Unicorn-8691.exe
4304	Unicorn-37907.exe
3228	Unicorn-57581.exe
5116	Unicorn-1373.exe
4360	Unicorn-16741.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 880 wrote to memory of 1568	880	a0066df62b75de9b50da22cbd62947c0N.exe	89
PID 880 wrote to memory of 1568	880	a0066df62b75de9b50da22cbd62947c0N.exe	89
PID 880 wrote to memory of 1568	880	a0066df62b75de9b50da22cbd62947c0N.exe	89
PID 1568 wrote to memory of 2476	1568	Unicorn-36989.exe	92
PID 1568 wrote to memory of 2476	1568	Unicorn-36989.exe	92
PID 1568 wrote to memory of 2476	1568	Unicorn-36989.exe	92
PID 880 wrote to memory of 2192	880	a0066df62b75de9b50da22cbd62947c0N.exe	93
PID 880 wrote to memory of 2192	880	a0066df62b75de9b50da22cbd62947c0N.exe	93
PID 880 wrote to memory of 2192	880	a0066df62b75de9b50da22cbd62947c0N.exe	93
PID 2476 wrote to memory of 2800	2476	Unicorn-53320.exe	97
PID 2476 wrote to memory of 2800	2476	Unicorn-53320.exe	97
PID 2476 wrote to memory of 2800	2476	Unicorn-53320.exe	97
PID 1568 wrote to memory of 3384	1568	Unicorn-36989.exe	98
PID 1568 wrote to memory of 3384	1568	Unicorn-36989.exe	98
PID 1568 wrote to memory of 3384	1568	Unicorn-36989.exe	98
PID 2192 wrote to memory of 424	2192	Unicorn-34523.exe	99
PID 2192 wrote to memory of 424	2192	Unicorn-34523.exe	99
PID 2192 wrote to memory of 424	2192	Unicorn-34523.exe	99
PID 880 wrote to memory of 2196	880	a0066df62b75de9b50da22cbd62947c0N.exe	100
PID 880 wrote to memory of 2196	880	a0066df62b75de9b50da22cbd62947c0N.exe	100
PID 880 wrote to memory of 2196	880	a0066df62b75de9b50da22cbd62947c0N.exe	100
PID 424 wrote to memory of 3688	424	Unicorn-7596.exe	101
PID 424 wrote to memory of 3688	424	Unicorn-7596.exe	101
PID 424 wrote to memory of 3688	424	Unicorn-7596.exe	101
PID 2192 wrote to memory of 2448	2192	Unicorn-34523.exe	102
PID 2192 wrote to memory of 2448	2192	Unicorn-34523.exe	102
PID 2192 wrote to memory of 2448	2192	Unicorn-34523.exe	102
PID 2800 wrote to memory of 964	2800	Unicorn-23056.exe	104
PID 3384 wrote to memory of 3440	3384	Unicorn-53268.exe	103
PID 2800 wrote to memory of 964	2800	Unicorn-23056.exe	104
PID 2800 wrote to memory of 964	2800	Unicorn-23056.exe	104
PID 3384 wrote to memory of 3440	3384	Unicorn-53268.exe	103
PID 3384 wrote to memory of 3440	3384	Unicorn-53268.exe	103
PID 2196 wrote to memory of 2620	2196	Unicorn-42307.exe	105
PID 2196 wrote to memory of 2620	2196	Unicorn-42307.exe	105
PID 2196 wrote to memory of 2620	2196	Unicorn-42307.exe	105
PID 880 wrote to memory of 1472	880	a0066df62b75de9b50da22cbd62947c0N.exe	107
PID 880 wrote to memory of 1472	880	a0066df62b75de9b50da22cbd62947c0N.exe	107
PID 880 wrote to memory of 1472	880	a0066df62b75de9b50da22cbd62947c0N.exe	107
PID 2476 wrote to memory of 2392	2476	Unicorn-53320.exe	106
PID 2476 wrote to memory of 2392	2476	Unicorn-53320.exe	106
PID 2476 wrote to memory of 2392	2476	Unicorn-53320.exe	106
PID 1568 wrote to memory of 3020	1568	Unicorn-36989.exe	108
PID 1568 wrote to memory of 3020	1568	Unicorn-36989.exe	108
PID 1568 wrote to memory of 3020	1568	Unicorn-36989.exe	108
PID 3688 wrote to memory of 1448	3688	Unicorn-15869.exe	109
PID 3688 wrote to memory of 1448	3688	Unicorn-15869.exe	109
PID 3688 wrote to memory of 1448	3688	Unicorn-15869.exe	109
PID 424 wrote to memory of 4312	424	Unicorn-7596.exe	110
PID 424 wrote to memory of 4312	424	Unicorn-7596.exe	110
PID 424 wrote to memory of 4312	424	Unicorn-7596.exe	110
PID 2448 wrote to memory of 5104	2448	Unicorn-19438.exe	111
PID 2448 wrote to memory of 5104	2448	Unicorn-19438.exe	111
PID 2448 wrote to memory of 5104	2448	Unicorn-19438.exe	111
PID 2192 wrote to memory of 3116	2192	Unicorn-34523.exe	112
PID 2192 wrote to memory of 3116	2192	Unicorn-34523.exe	112
PID 2192 wrote to memory of 3116	2192	Unicorn-34523.exe	112
PID 3440 wrote to memory of 1272	3440	Unicorn-23845.exe	113
PID 3440 wrote to memory of 1272	3440	Unicorn-23845.exe	113
PID 3440 wrote to memory of 1272	3440	Unicorn-23845.exe	113
PID 3384 wrote to memory of 2672	3384	Unicorn-53268.exe	114
PID 3384 wrote to memory of 2672	3384	Unicorn-53268.exe	114
PID 3384 wrote to memory of 2672	3384	Unicorn-53268.exe	114
PID 964 wrote to memory of 2760	964	Unicorn-23845.exe	115

C:\Users\Admin\AppData\Local\Temp\a0066df62b75de9b50da22cbd62947c0N.exe
"C:\Users\Admin\AppData\Local\Temp\a0066df62b75de9b50da22cbd62947c0N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:880
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36989.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36989.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53320.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53320.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23056.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23056.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23845.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10575.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47192.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32792.exe
        8⤵
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60257.exe
        9⤵
        
        PID:8024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35868.exe
        10⤵
        
        PID:6868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36353.exe
        10⤵
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39743.exe
        9⤵
        
        PID:11000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5158.exe
        9⤵
        
        PID:1372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31450.exe
        9⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50283.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24153.exe
        8⤵
        
        PID:11360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28954.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42975.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37580.exe
        8⤵
        
        PID:8912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27927.exe
        8⤵
        
        PID:13320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23088.exe
        8⤵
        
        PID:1972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43847.exe
        7⤵
        
        PID:7680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59908.exe
        8⤵
        
        PID:14320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28097.exe
        8⤵
        
        PID:4092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18498.exe
        7⤵
        
        PID:12700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56609.exe
        7⤵
        
        PID:15520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62412.exe
        6⤵
        Executes dropped EXE
        
        PID:3632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39917.exe
        7⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33625.exe
        8⤵
        
        PID:5608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25769.exe
        9⤵
        
        PID:9752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27743.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:13300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36551.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23499.exe
        8⤵
        
        PID:13836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20288.exe
        8⤵
        
        PID:1712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37490.exe
        7⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51140.exe
        8⤵
        
        PID:10704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17520.exe
        8⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28294.exe
        7⤵
        
        PID:9824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26187.exe
        7⤵
        
        PID:14344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12608.exe
        7⤵
        
        PID:15376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38395.exe
        6⤵
        
        PID:6284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55929.exe
        7⤵
        
        PID:7836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9567.exe
        7⤵
        
        PID:11268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64994.exe
        7⤵
        
        PID:5224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53656.exe
        6⤵
        
        PID:8428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5126.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24033.exe
        6⤵
        
        PID:17116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16859.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3995.exe
        6⤵
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56912.exe
        7⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-475.exe
        8⤵
        
        PID:7756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41258.exe
        8⤵
        
        PID:9916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36679.exe
        8⤵
        
        PID:14880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42119.exe
        7⤵
        
        PID:7344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37417.exe
        8⤵
        
        PID:16980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22425.exe
        7⤵
        
        PID:9780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6832.exe
        7⤵
        
        PID:2064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54430.exe
        6⤵
        
        PID:6316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61316.exe
        7⤵
        
        PID:10296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46296.exe
        7⤵
        
        PID:15024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12815.exe
        6⤵
        
        PID:8460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60948.exe
        7⤵
        
        PID:13264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20505.exe
        7⤵
        
        PID:16300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62592.exe
        6⤵
        
        PID:13700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56283.exe
        6⤵
        
        PID:16268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-413.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55952.exe
        6⤵
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35945.exe
        7⤵
        
        PID:8036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1747.exe
        8⤵
        
        PID:10944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44714.exe
        8⤵
        
        PID:5232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39743.exe
        7⤵
        
        PID:11016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5158.exe
        7⤵
        
        PID:15336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29530.exe
        7⤵
        
        PID:5216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17039.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22425.exe
        6⤵
        
        PID:10760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31440.exe
        6⤵
        
        PID:16312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61172.exe
        5⤵
        
        PID:6340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30164.exe
        6⤵
        
        PID:7520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25218.exe
        6⤵
        
        PID:10568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21273.exe
        6⤵
        
        PID:6620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36630.exe
        5⤵
        
        PID:8608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54512.exe
        5⤵
        
        PID:3972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24955.exe
        5⤵
        
        PID:17164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63268.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63268.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36725.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54125.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55848.exe
        7⤵
        
        PID:5272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60861.exe
        8⤵
        
        PID:6264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37580.exe
        9⤵
        
        PID:8896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11783.exe
        9⤵
        
        PID:12024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23088.exe
        9⤵
        
        PID:3524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56530.exe
        8⤵
        
        PID:9212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9155.exe
        9⤵
        
        PID:14516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9353.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:4496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47528.exe
        8⤵
        
        PID:12976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31912.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49306.exe
        7⤵
        
        PID:7140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33194.exe
        8⤵
        
        PID:11300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57786.exe
        8⤵
        
        PID:16604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40880.exe
        7⤵
        
        PID:9808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13297.exe
        7⤵
        
        PID:13696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46372.exe
        6⤵
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58425.exe
        7⤵
        
        PID:6164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28473.exe
        8⤵
        
        PID:10524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26015.exe
        8⤵
        
        PID:13976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41345.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6033.exe
        7⤵
        
        PID:9688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10918.exe
        7⤵
        
        PID:12544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12710.exe
        6⤵
        
        PID:7568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19532.exe
        7⤵
        
        PID:12336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21470.exe
        7⤵
        
        PID:3392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11466.exe
        6⤵
        
        PID:9572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15046.exe
        6⤵
        
        PID:14736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11675.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14431.exe
        6⤵
        
        PID:5404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18485.exe
        7⤵
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11923.exe
        8⤵
        
        PID:10576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30343.exe
        8⤵
        
        PID:15156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50283.exe
        7⤵
        
        PID:8212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38483.exe
        7⤵
        
        PID:13340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55649.exe
        7⤵
        
        PID:1376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10215.exe
        6⤵
        
        PID:7552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51057.exe
        7⤵
        
        PID:10764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2912.exe
        7⤵
        
        PID:16680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51618.exe
        6⤵
        
        PID:10532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24743.exe
        6⤵
        
        PID:15132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25317.exe
        5⤵
        
        PID:5952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16324.exe
        6⤵
        
        PID:6388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37417.exe
        7⤵
        
        PID:16968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22727.exe
        6⤵
        
        PID:9784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54063.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52400.exe
        5⤵
        
        PID:7808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52194.exe
        5⤵
        
        PID:9832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17343.exe
        5⤵
        
        PID:14896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5898.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5898.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6543.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27509.exe
        6⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47657.exe
        7⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63153.exe
        8⤵
        
        PID:9036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27927.exe
        8⤵
        
        PID:13352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59902.exe
        8⤵
        
        PID:15532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21366.exe
        7⤵
        
        PID:10088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23499.exe
        7⤵
        
        PID:4240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10874.exe
        6⤵
        
        PID:6760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19641.exe
        7⤵
        
        PID:12416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2441.exe
        7⤵
        
        PID:15916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36250.exe
        6⤵
        
        PID:10004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23499.exe
        6⤵
        
        PID:1344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13310.exe
        5⤵
        
        PID:6116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8160.exe
        6⤵
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51140.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-696.exe
        7⤵
        
        PID:5368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17522.exe
        6⤵
        
        PID:6236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41087.exe
        6⤵
        
        PID:13648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27297.exe
        5⤵
        
        PID:6204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5016.exe
        6⤵
        
        PID:6016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22943.exe
        6⤵
        
        PID:14864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30979.exe
        5⤵
        
        PID:8160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8118.exe
        5⤵
        
        PID:13208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22423.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22423.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27509.exe
        5⤵
        
        PID:5728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25841.exe
        6⤵
        
        PID:6192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8176.exe
        7⤵
        
        PID:8704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50577.exe
        7⤵
        
        PID:16324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18207.exe
        6⤵
        
        PID:8148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1398.exe
        6⤵
        
        PID:13468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15689.exe
        6⤵
        
        PID:5260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46728.exe
        5⤵
        
        PID:6656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20876.exe
        6⤵
        
        PID:13456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9353.exe
        6⤵
        
        PID:3744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19768.exe
        5⤵
        
        PID:9552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16783.exe
        5⤵
        
        PID:12468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50478.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50478.exe
      4⤵
      PID:5628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63713.exe
        5⤵
        
        PID:7656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25218.exe
        5⤵
        
        PID:10852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55591.exe
        5⤵
        
        PID:15892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59867.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59867.exe
      4⤵
      PID:4472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4504.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4504.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34456.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34456.exe
      4⤵
      PID:5308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53268.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53268.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23845.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23845.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36341.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31541.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40280.exe
        7⤵
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64268.exe
        8⤵
        
        PID:6920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21575.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:9956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45703.exe
        9⤵
        
        PID:14400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54616.exe
        8⤵
        
        PID:8448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40319.exe
        8⤵
        
        PID:12908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56530.exe
        8⤵
        
        PID:1512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8657.exe
        7⤵
        
        PID:6176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5016.exe
        8⤵
        
        PID:10284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46296.exe
        8⤵
        
        PID:15040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32816.exe
        7⤵
        
        PID:8860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14833.exe
        7⤵
        
        PID:14116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37430.exe
        6⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14704.exe
        7⤵
        
        PID:7444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43844.exe
        8⤵
        
        PID:11812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9353.exe
        8⤵
        
        PID:3260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8690.exe
        7⤵
        
        PID:10412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41071.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57199.exe
        6⤵
        
        PID:884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18764.exe
        7⤵
        
        PID:12788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61434.exe
        7⤵
        
        PID:5888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11369.exe
        6⤵
        
        PID:9684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15377.exe
        6⤵
        
        PID:15732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52215.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59600.exe
        6⤵
        
        PID:5944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55929.exe
        7⤵
        
        PID:8144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20876.exe
        8⤵
        
        PID:13500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9353.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34455.exe
        7⤵
        
        PID:11452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5897.exe
        7⤵
        
        PID:16068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59520.exe
        6⤵
        
        PID:8136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-323.exe
        7⤵
        
        PID:14784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49535.exe
        6⤵
        
        PID:12088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57106.exe
        6⤵
        
        PID:15424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16337.exe
        5⤵
        
        PID:5624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56796.exe
        6⤵
        
        PID:9972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4858.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54419.exe
        5⤵
        
        PID:9108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22718.exe
        5⤵
        
        PID:12124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30089.exe
        5⤵
        
        PID:15440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56247.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56247.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28552.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23176.exe
        6⤵
        
        PID:5248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19445.exe
        7⤵
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19993.exe
        8⤵
        
        PID:7824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51140.exe
        9⤵
        
        PID:11052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58746.exe
        9⤵
        
        PID:4428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1295.exe
        8⤵
        
        PID:9740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36679.exe
        8⤵
        
        PID:14888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2239.exe
        7⤵
        
        PID:8020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60564.exe
        8⤵
        
        PID:12432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11657.exe
        8⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6774.exe
        7⤵
        
        PID:11948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12809.exe
        7⤵
        
        PID:4872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27983.exe
        6⤵
        
        PID:7100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37580.exe
        7⤵
        
        PID:9024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50704.exe
        7⤵
        
        PID:11484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51241.exe
        7⤵
        
        PID:15368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57599.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47528.exe
        6⤵
        
        PID:13388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47118.exe
        6⤵
        
        PID:15952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46372.exe
        5⤵
        
        PID:5492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63500.exe
        6⤵
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28364.exe
        7⤵
        
        PID:11364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42839.exe
        7⤵
        
        PID:13244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34818.exe
        6⤵
        
        PID:7080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41663.exe
        6⤵
        
        PID:13004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6561.exe
        6⤵
        
        PID:5328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28646.exe
        5⤵
        
        PID:7116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25868.exe
        6⤵
        
        PID:10948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48984.exe
        6⤵
        
        PID:13212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9632.exe
        6⤵
        
        PID:452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47320.exe
        5⤵
        
        PID:9276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49335.exe
        5⤵
        
        PID:14240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40177.exe
        5⤵
        
        PID:16952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9074.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9074.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24328.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50280.exe
        6⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51212.exe
        7⤵
        
        PID:7952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11761.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39743.exe
        7⤵
        
        PID:10976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5158.exe
        7⤵
        
        PID:15344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25586.exe
        6⤵
        
        PID:5604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23769.exe
        6⤵
        
        PID:12184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28954.exe
        6⤵
        
        PID:13228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59011.exe
        5⤵
        
        PID:6472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60548.exe
        6⤵
        
        PID:10748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55040.exe
        6⤵
        
        PID:15204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38938.exe
        5⤵
        
        PID:8684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19532.exe
        6⤵
        
        PID:12520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13769.exe
        6⤵
        
        PID:1636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38488.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7024.exe
        5⤵
        
        PID:6624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32911.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32911.exe
      4⤵
      PID:6100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37490.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61425.exe
        6⤵
        
        PID:10788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45611.exe
        6⤵
        
        PID:15268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41450.exe
        5⤵
        
        PID:9576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16783.exe
        5⤵
        
        PID:13136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49495.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49495.exe
      4⤵
      PID:6812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63449.exe
        5⤵
        
        PID:720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51642.exe
        5⤵
        
        PID:15720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-433.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-433.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8648.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8648.exe
      4⤵
      PID:13064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11466.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11466.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36725.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36725.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6351.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49133.exe
        6⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60861.exe
        7⤵
        
        PID:6272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10226.exe
        8⤵
        
        PID:12028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23088.exe
        8⤵
        
        PID:1820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42306.exe
        7⤵
        
        PID:8356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24153.exe
        7⤵
        
        PID:11136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31834.exe
        7⤵
        
        PID:4172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2602.exe
        6⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61316.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46296.exe
        7⤵
        
        PID:15016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48554.exe
        6⤵
        
        PID:9168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47528.exe
        6⤵
        
        PID:13372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14912.exe
        6⤵
        
        PID:15812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6382.exe
        5⤵
        
        PID:5772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58425.exe
        6⤵
        
        PID:6644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10226.exe
        7⤵
        
        PID:12040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23088.exe
        7⤵
        
        PID:13232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6033.exe
        6⤵
        
        PID:9696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49752.exe
        6⤵
        
        PID:15244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44423.exe
        5⤵
        
        PID:7716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35873.exe
        6⤵
        
        PID:11060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61434.exe
        6⤵
        
        PID:5428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52691.exe
        5⤵
        
        PID:9580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33878.exe
        5⤵
        
        PID:14836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62412.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62412.exe
      4⤵
      Executes dropped EXE
      PID:3520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42029.exe
        5⤵
        
        PID:5908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46796.exe
        6⤵
        
        PID:8932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15810.exe
        6⤵
        
        PID:12296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34624.exe
        6⤵
        
        PID:16420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25311.exe
        5⤵
        
        PID:7696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6774.exe
        5⤵
        
        PID:11972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4833.exe
        5⤵
        
        PID:1992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34694.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34694.exe
      4⤵
      PID:7220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27809.exe
        5⤵
        
        PID:12472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44714.exe
        5⤵
        
        PID:6128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10962.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10962.exe
      4⤵
      PID:10588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41809.exe
      4⤵
      PID:15124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51727.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51727.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47384.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47384.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49517.exe
        5⤵
        
        PID:5648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53931.exe
        6⤵
        
        PID:7688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5793.exe
        6⤵
        
        PID:10596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6161.exe
        6⤵
        
        PID:6908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15119.exe
        5⤵
        
        PID:7640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20876.exe
        6⤵
        
        PID:13492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52794.exe
        6⤵
        
        PID:15852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54418.exe
        5⤵
        
        PID:10540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49944.exe
        5⤵
        
        PID:15188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55258.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55258.exe
      4⤵
      PID:6692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15192.exe
        5⤵
        
        PID:9088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15810.exe
        5⤵
        
        PID:11792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23088.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14543.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14543.exe
      4⤵
      PID:6668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20876.exe
        5⤵
        
        PID:13484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9353.exe
        5⤵
        
        PID:3488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10025.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10025.exe
      4⤵
      PID:12612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13566.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13566.exe
      4⤵
      PID:1156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12797.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12797.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2236.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2236.exe
      4⤵
      PID:5692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16324.exe
        5⤵
        
        PID:5372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44337.exe
        6⤵
        
        PID:12804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18097.exe
        6⤵
        
        PID:5180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27714.exe
        5⤵
        
        PID:9672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49752.exe
        5⤵
        
        PID:15252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46147.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46147.exe
      4⤵
      PID:7772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54994.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54994.exe
      4⤵
      PID:9992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42544.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42544.exe
      4⤵
      PID:14824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7710.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7710.exe
    3⤵
    PID:6108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29609.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15810.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15810.exe
      4⤵
      PID:11816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51241.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51241.exe
      4⤵
      PID:15416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21571.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21571.exe
    3⤵
    PID:7724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21369.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21369.exe
      4⤵
      PID:11620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20505.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20505.exe
      4⤵
      PID:16244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64162.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64162.exe
    3⤵
    PID:11152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18202.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18202.exe
    3⤵
    PID:13224
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34523.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34523.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7596.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7596.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15869.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15869.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9615.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14908.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16741.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17525.exe
        8⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61316.exe
        9⤵
        
        PID:10460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54464.exe
        9⤵
        
        PID:15080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25311.exe
        8⤵
        
        PID:7456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20409.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:12160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9353.exe
        9⤵
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6774.exe
        8⤵
        
        PID:11916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31450.exe
        8⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42098.exe
        7⤵
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-496.exe
        8⤵
        
        PID:9908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4858.exe
        8⤵
        
        PID:13724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43847.exe
        7⤵
        
        PID:8316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43195.exe
        7⤵
        
        PID:12752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22784.exe
        7⤵
        
        PID:5744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37907.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17525.exe
        7⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64097.exe
        8⤵
        
        PID:7996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9567.exe
        8⤵
        
        PID:10152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7137.exe
        8⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25311.exe
        7⤵
        
        PID:7800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6774.exe
        7⤵
        
        PID:11940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28954.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55834.exe
        6⤵
        
        PID:6732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61316.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46296.exe
        7⤵
        
        PID:15008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32800.exe
        6⤵
        
        PID:8188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13014.exe
        6⤵
        
        PID:12832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15486.exe
        6⤵
        
        PID:5756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44244.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16741.exe
        6⤵
        Executes dropped EXE
        
        PID:5008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58173.exe
        7⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7024.exe
        8⤵
        
        PID:8880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15810.exe
        8⤵
        
        PID:11732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23088.exe
        8⤵
        
        PID:13200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43655.exe
        7⤵
        
        PID:8496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46184.exe
        7⤵
        
        PID:12896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61705.exe
        7⤵
        
        PID:852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43250.exe
        6⤵
        
        PID:7020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5016.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54464.exe
        7⤵
        
        PID:15088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57599.exe
        6⤵
        
        PID:9148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47528.exe
        6⤵
        
        PID:13364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48441.exe
        6⤵
        
        PID:15400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1373.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25672.exe
        6⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27668.exe
        7⤵
        
        PID:7496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8690.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34927.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40391.exe
        6⤵
        
        PID:8008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58268.exe
        7⤵
        
        PID:14964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53479.exe
        6⤵
        
        PID:10984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11023.exe
        6⤵
        
        PID:15320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56647.exe
        5⤵
        
        PID:5220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40761.exe
        6⤵
        
        PID:9240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13703.exe
        6⤵
        
        PID:14140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60281.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30086.exe
        5⤵
        
        PID:8180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52976.exe
        5⤵
        
        PID:11856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56179.exe
        5⤵
        
        PID:1148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13979.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13979.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5095.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32392.exe
        6⤵
        
        PID:3280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48936.exe
        7⤵
        
        PID:5676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10288.exe
        8⤵
        
        PID:7608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11368.exe
        9⤵
        
        PID:8656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15408.exe
        9⤵
        
        PID:16504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40682.exe
        8⤵
        
        PID:10548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44079.exe
        8⤵
        
        PID:15140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34527.exe
        7⤵
        
        PID:7200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2026.exe
        8⤵
        
        PID:17296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53479.exe
        7⤵
        
        PID:11008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11023.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34038.exe
        6⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35292.exe
        7⤵
        
        PID:13072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53074.exe
        7⤵
        
        PID:5976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42115.exe
        6⤵
        
        PID:9996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14833.exe
        6⤵
        
        PID:14188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54436.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10015.exe
        6⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35945.exe
        7⤵
        
        PID:7988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18764.exe
        8⤵
        
        PID:12712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51642.exe
        8⤵
        
        PID:15712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39743.exe
        7⤵
        
        PID:10992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5158.exe
        7⤵
        
        PID:15328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25311.exe
        6⤵
        
        PID:7676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45572.exe
        7⤵
        
        PID:12996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36545.exe
        7⤵
        
        PID:1204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6774.exe
        6⤵
        
        PID:11892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28954.exe
        6⤵
        
        PID:2996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41719.exe
        5⤵
        
        PID:7072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31721.exe
        6⤵
        
        PID:8980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15810.exe
        6⤵
        
        PID:11804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7328.exe
        6⤵
        
        PID:3628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63464.exe
        5⤵
        
        PID:9008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38863.exe
        5⤵
        
        PID:12840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6270.exe
        5⤵
        
        PID:15680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48166.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48166.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57581.exe
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48936.exe
        6⤵
        
        PID:5656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56033.exe
        7⤵
        
        PID:9000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5011.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45399.exe
        8⤵
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15810.exe
        7⤵
        
        PID:12376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32901.exe
        7⤵
        
        PID:608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43655.exe
        6⤵
        
        PID:8504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46184.exe
        6⤵
        
        PID:12884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40273.exe
        6⤵
        
        PID:15380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34038.exe
        5⤵
        
        PID:6172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18393.exe
        6⤵
        
        PID:11096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41859.exe
        6⤵
        
        PID:13160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30101.exe
        6⤵
        
        PID:5184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64315.exe
        5⤵
        
        PID:9920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15793.exe
        5⤵
        
        PID:14268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8691.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8691.exe
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:2684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56839.exe
        5⤵
        
        PID:6408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61316.exe
        6⤵
        
        PID:10468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54464.exe
        6⤵
        
        PID:15096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47599.exe
        5⤵
        
        PID:8564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45395.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25493.exe
        5⤵
        
        PID:17092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52507.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52507.exe
      4⤵
      PID:6380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2623.exe
        5⤵
        
        PID:6852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6774.exe
        5⤵
        
        PID:11924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28954.exe
        5⤵
        
        PID:1916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28242.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28242.exe
      4⤵
      PID:7984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45921.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45921.exe
      4⤵
      PID:11468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39313.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39313.exe
      4⤵
      PID:16700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19438.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19438.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-295.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-295.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61608.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47405.exe
        6⤵
        
        PID:3312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1559.exe
        7⤵
        
        PID:6708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63713.exe
        8⤵
        
        PID:7600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25218.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37914.exe
        8⤵
        
        PID:3356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4833.exe
        8⤵
        
        PID:3048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-702.exe
        7⤵
        
        PID:8956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35411.exe
        7⤵
        
        PID:11504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20288.exe
        7⤵
        
        PID:3956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41571.exe
        6⤵
        
        PID:6356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2416.exe
        7⤵
        
        PID:10024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28127.exe
        7⤵
        
        PID:13608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39431.exe
        6⤵
        
        PID:8532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45395.exe
        6⤵
        
        PID:11488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40761.exe
        6⤵
        
        PID:17044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-622.exe
        5⤵
        
        PID:4752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41645.exe
        6⤵
        
        PID:744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41897.exe
        7⤵
        
        PID:6324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61316.exe
        8⤵
        
        PID:10308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46296.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6033.exe
        7⤵
        
        PID:9704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10918.exe
        7⤵
        
        PID:13336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28954.exe
        7⤵
        
        PID:1296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54315.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29827.exe
        6⤵
        
        PID:12056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20288.exe
        6⤵
        
        PID:3388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55307.exe
        5⤵
        
        PID:6368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8176.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50320.exe
        6⤵
        
        PID:13216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16368.exe
        6⤵
        
        PID:15692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53464.exe
        5⤵
        
        PID:8552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36729.exe
        5⤵
        
        PID:11496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33462.exe
        5⤵
        
        PID:17028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9454.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9454.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22984.exe
        5⤵
        
        PID:5100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9247.exe
        6⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37580.exe
        7⤵
        
        PID:8968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50704.exe
        7⤵
        
        PID:12620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40001.exe
        7⤵
        
        PID:368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56338.exe
        6⤵
        
        PID:8892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44923.exe
        6⤵
        
        PID:11808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31824.exe
        6⤵
        
        PID:15640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34038.exe
        5⤵
        
        PID:5228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37580.exe
        6⤵
        
        PID:8312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35711.exe
        6⤵
        
        PID:13688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58553.exe
        6⤵
        
        PID:16256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40195.exe
        5⤵
        
        PID:9844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38679.exe
        5⤵
        
        PID:13284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59038.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59038.exe
      4⤵
      PID:5588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46147.exe
        5⤵
        
        PID:7740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26444.exe
        6⤵
        
        PID:11256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48849.exe
        6⤵
        
        PID:15976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29827.exe
        5⤵
        
        PID:12064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20288.exe
        5⤵
        
        PID:3732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-210.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-210.exe
      4⤵
      PID:7764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11176.exe
        5⤵
        
        PID:5044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24178.exe
        5⤵
        
        PID:14312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1272.exe
        5⤵
        
        PID:5844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44026.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44026.exe
      4⤵
      PID:9540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17343.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17343.exe
      4⤵
      PID:14872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30210.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30210.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4732.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4732.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46445.exe
        5⤵
        
        PID:2848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41645.exe
        6⤵
        
        PID:1788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60729.exe
        7⤵
        
        PID:7124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52017.exe
        8⤵
        
        PID:11224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32.exe
        8⤵
        
        PID:15668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22727.exe
        7⤵
        
        PID:8416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4670.exe
        7⤵
        
        PID:13580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28954.exe
        7⤵
        
        PID:4416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33183.exe
        6⤵
        
        PID:7860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27513.exe
        7⤵
        
        PID:11144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42042.exe
        7⤵
        
        PID:12960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25968.exe
        7⤵
        
        PID:5452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29529.exe
        6⤵
        
        PID:10720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26915.exe
        7⤵
        
        PID:15704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6545.exe
        6⤵
        
        PID:16492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18065.exe
        5⤵
        
        PID:6784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61316.exe
        6⤵
        
        PID:10452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54464.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21663.exe
        5⤵
        
        PID:8640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47031.exe
        5⤵
        
        PID:13840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40566.exe
        5⤵
        
        PID:15448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3310.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3310.exe
      4⤵
      PID:5240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48936.exe
        5⤵
        
        PID:5332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20377.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25897.exe
        7⤵
        
        PID:14940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56443.exe
        6⤵
        
        PID:10416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9953.exe
        6⤵
        
        PID:15052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65467.exe
        5⤵
        
        PID:7424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6774.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13193.exe
        5⤵
        
        PID:3264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40567.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40567.exe
      4⤵
      PID:6764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20372.exe
        5⤵
        
        PID:8816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64819.exe
        5⤵
        
        PID:11628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23088.exe
        5⤵
        
        PID:14312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7418.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7418.exe
      4⤵
      PID:5212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50482.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50482.exe
      4⤵
      PID:12548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15486.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15486.exe
      4⤵
      PID:5312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53476.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53476.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22792.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22792.exe
      4⤵
      PID:5152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32792.exe
        5⤵
        
        PID:6024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54476.exe
        6⤵
        
        PID:7868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35881.exe
        7⤵
        
        PID:6580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25218.exe
        6⤵
        
        PID:10828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40490.exe
        6⤵
        
        PID:15912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50283.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49535.exe
        5⤵
        
        PID:12096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28954.exe
        5⤵
        
        PID:1340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26831.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26831.exe
      4⤵
      PID:6772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13272.exe
        5⤵
        
        PID:8832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15810.exe
        5⤵
        
        PID:11780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23088.exe
        5⤵
        
        PID:2360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43847.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43847.exe
      4⤵
      PID:7560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59531.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59531.exe
      4⤵
      PID:12824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48441.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48441.exe
      4⤵
      PID:15408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31541.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31541.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50537.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50537.exe
      4⤵
      PID:6220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5016.exe
        5⤵
        
        PID:7856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22943.exe
        5⤵
        
        PID:14912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1871.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1871.exe
      4⤵
      PID:8200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1398.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1398.exe
      4⤵
      PID:13476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22041.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22041.exe
      4⤵
      PID:15904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31890.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31890.exe
    3⤵
    PID:7088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5016.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5016.exe
      4⤵
      PID:9260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22943.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22943.exe
      4⤵
      PID:14920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17498.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17498.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:9264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52654.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52654.exe
    3⤵
    PID:12664
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42307.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42307.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15677.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15677.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36725.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36725.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31048.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51437.exe
        6⤵
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33428.exe
        7⤵
        
        PID:6248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29817.exe
        8⤵
        
        PID:11512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9353.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6033.exe
        7⤵
        
        PID:9712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10918.exe
        7⤵
        
        PID:13128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15119.exe
        6⤵
        
        PID:7648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56707.exe
        7⤵
        
        PID:16228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29827.exe
        6⤵
        
        PID:12048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20288.exe
        6⤵
        
        PID:2652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62620.exe
        5⤵
        
        PID:5188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39401.exe
        6⤵
        
        PID:7464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19532.exe
        7⤵
        
        PID:12344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2057.exe
        7⤵
        
        PID:15872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25218.exe
        6⤵
        
        PID:10780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28954.exe
        6⤵
        
        PID:3556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32886.exe
        5⤵
        
        PID:8164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19724.exe
        6⤵
        
        PID:10816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2633.exe
        6⤵
        
        PID:15928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12639.exe
        5⤵
        
        PID:11872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20288.exe
        5⤵
        
        PID:848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2822.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2822.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42029.exe
        5⤵
        
        PID:5476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30164.exe
        6⤵
        
        PID:7588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46083.exe
        6⤵
        
        PID:12012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35295.exe
        5⤵
        
        PID:6060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18764.exe
        6⤵
        
        PID:12796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61242.exe
        6⤵
        
        PID:5256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6774.exe
        5⤵
        
        PID:11900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57106.exe
        5⤵
        
        PID:4272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51040.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51040.exe
      4⤵
      PID:6876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46817.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35711.exe
        5⤵
        
        PID:13680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23960.exe
        5⤵
        
        PID:6572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55183.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55183.exe
      4⤵
      PID:9252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22986.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22986.exe
      4⤵
      PID:14108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65219.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65219.exe
      4⤵
      PID:6564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15598.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15598.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30581.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30581.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20488.exe
        5⤵
        
        PID:4856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17525.exe
        6⤵
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53516.exe
        7⤵
        
        PID:7228
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7228 -s 716
        8⤵
        Program crash
        
        PID:13016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45691.exe
        7⤵
        
        PID:11200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        7⤵
        
        PID:13280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38767.exe
        7⤵
        
        PID:716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25311.exe
        6⤵
        
        PID:7596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6774.exe
        6⤵
        
        PID:11908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28954.exe
        6⤵
        
        PID:2488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42098.exe
        5⤵
        
        PID:6788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63900.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15810.exe
        6⤵
        
        PID:11776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23088.exe
        6⤵
        
        PID:4948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2814.exe
        5⤵
        
        PID:8540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19532.exe
        6⤵
        
        PID:12320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9353.exe
        6⤵
        
        PID:5040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43195.exe
        5⤵
        
        PID:12744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6832.exe
        5⤵
        
        PID:5236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1006.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1006.exe
      4⤵
      PID:4992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10015.exe
        5⤵
        
        PID:5924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54476.exe
        6⤵
        
        PID:7636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9560.exe
        7⤵
        
        PID:14804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55778.exe
        6⤵
        
        PID:12968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57106.exe
        6⤵
        
        PID:15432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33479.exe
        5⤵
        
        PID:7788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44612.exe
        6⤵
        
        PID:13292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20889.exe
        6⤵
        
        PID:6976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6774.exe
        5⤵
        
        PID:11964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57106.exe
        5⤵
        
        PID:2336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56711.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56711.exe
      4⤵
      PID:6816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49313.exe
        5⤵
        
        PID:9764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27743.exe
        5⤵
        
        PID:6864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49712.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49712.exe
      4⤵
      PID:8348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34529.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34529.exe
      4⤵
      PID:12768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14905.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14905.exe
      4⤵
      PID:16460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15021.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15021.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20872.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20872.exe
      4⤵
      PID:756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60285.exe
        5⤵
        
        PID:5768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3843.exe
        6⤵
        
        PID:8572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9842.exe
        6⤵
        
        PID:11760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51153.exe
        6⤵
        
        PID:16992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25311.exe
        5⤵
        
        PID:7488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20684.exe
        6⤵
        
        PID:13056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60282.exe
        6⤵
        
        PID:7288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6774.exe
        5⤵
        
        PID:11956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28954.exe
        5⤵
        
        PID:13224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34038.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34038.exe
      4⤵
      PID:6232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43641.exe
        5⤵
        
        PID:10124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3898.exe
        5⤵
        
        PID:14164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41264.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41264.exe
      4⤵
      PID:9836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38679.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38679.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22527.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22527.exe
    3⤵
    PID:5140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58640.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58640.exe
      4⤵
      PID:5996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12784.exe
        5⤵
        
        PID:7368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46083.exe
        5⤵
        
        PID:11380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56338.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56338.exe
      4⤵
      PID:8876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35292.exe
        5⤵
        
        PID:13024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9353.exe
        5⤵
        
        PID:3568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31384.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31384.exe
      4⤵
      PID:3840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20288.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20288.exe
      4⤵
      PID:1016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12001.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12001.exe
    3⤵
    PID:6880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5016.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5016.exe
      4⤵
      PID:9940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22943.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22943.exe
      4⤵
      PID:14928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24511.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24511.exe
    3⤵
    PID:8452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50572.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50572.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35060.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35060.exe
    3⤵
    PID:12760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2744.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2744.exe
    3⤵
    PID:15508
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17331.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17331.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48567.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48567.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31432.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31432.exe
      4⤵
      PID:2472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57104.exe
        5⤵
        
        PID:5392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54476.exe
        6⤵
        
        PID:7672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25218.exe
        6⤵
        
        PID:10692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6310.exe
        6⤵
        
        PID:14444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19151.exe
        5⤵
        
        PID:8176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6774.exe
        5⤵
        
        PID:11932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38767.exe
        5⤵
        
        PID:4320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17210.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17210.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43641.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3898.exe
        5⤵
        
        PID:14160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64978.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64978.exe
      4⤵
      PID:3288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18690.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18690.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32021.exe
      4⤵
      PID:5536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-797.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-797.exe
    3⤵
    PID:1244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59600.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59600.exe
      4⤵
      PID:5968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61316.exe
        5⤵
        
        PID:10268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46296.exe
        5⤵
        
        PID:15000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23088.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25586.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25586.exe
      4⤵
      PID:7948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28961.exe
        5⤵
        
        PID:12084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9353.exe
        5⤵
        
        PID:13192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47528.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47528.exe
      4⤵
      PID:13380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30101.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30101.exe
      4⤵
      PID:4488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62851.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62851.exe
    3⤵
    PID:7028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48140.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48140.exe
      4⤵
      PID:8644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50.exe
      4⤵
      PID:13236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1464.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1464.exe
      4⤵
      PID:5436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54799.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54799.exe
    3⤵
    PID:9056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22327.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22327.exe
    3⤵
    PID:12732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64643.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64643.exe
    3⤵
    PID:16292
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26725.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26725.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5391.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5391.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26056.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26056.exe
      4⤵
      PID:5664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42665.exe
        5⤵
        
        PID:1348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20969.exe
        6⤵
        
        PID:2872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4111.exe
        6⤵
        
        PID:14724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6033.exe
        5⤵
        
        PID:8480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10918.exe
        5⤵
        
        PID:12608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55083.exe
      4⤵
      PID:7628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14838.exe
      4⤵
      PID:7348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23712.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23712.exe
      4⤵
      PID:14712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45983.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45983.exe
    3⤵
    PID:2044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65036.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65036.exe
      4⤵
      PID:6748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51140.exe
        5⤵
        
        PID:10804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9632.exe
        5⤵
        
        PID:5860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26567.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26567.exe
      4⤵
      PID:8320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49447.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49447.exe
      4⤵
      PID:13668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31746.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31746.exe
      4⤵
      PID:16448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60463.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60463.exe
    3⤵
    PID:7112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30113.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30113.exe
      4⤵
      PID:12924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35777.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35777.exe
      4⤵
      PID:5504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25634.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25634.exe
    3⤵
    PID:9512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8118.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8118.exe
    3⤵
    PID:13424
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45846.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45846.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14919.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14919.exe
    3⤵
    PID:6052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46796.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46796.exe
      4⤵
      PID:8944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15810.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15810.exe
      4⤵
      PID:11800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64505.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64505.exe
      4⤵
      PID:4160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7802.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7802.exe
    3⤵
    PID:7380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40843.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40843.exe
      4⤵
      PID:15964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22425.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22425.exe
    3⤵
    PID:10968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64009.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64009.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5832
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12196.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12196.exe
  2⤵
  PID:6300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20585.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20585.exe
    3⤵
    PID:10820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45611.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45611.exe
    3⤵
    PID:15276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-696.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-696.exe
    3⤵
    PID:5748
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23990.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23990.exe
  2⤵
  PID:8436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44337.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44337.exe
    3⤵
    PID:13104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61434.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61434.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1976
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44327.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44327.exe
  2⤵
  PID:11524
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18433.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18433.exe
  2⤵
  PID:17128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 7228 -ip 7228
1⤵
PID:14276

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:15800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10575.exe

Filesize
468KB

MD5
f7716f8fbb7a194f1dc5ba19262498af

SHA1
37b5ebf33ec306b0a284d63ad1ecda1f693a1582

SHA256
fa3652fbb187241d2efe1c1e46a89fbb9593d7afe46bcf298f87ea8c0e56047a

SHA512
ef5d172a6a92c465c1e152063e60554594e7a4e0f1a4c6fa8752635abd8a558bdde3d6a2e573b4710d42081a3ee9726b6f014e08756de5b42138b6569b495931

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11466.exe

Filesize
468KB

MD5
a81a880d6fdd0953ed592df0ef23797d

SHA1
5727e64e2f6c28c9abf60f2c936aa57ea776e9bd

SHA256
acebec3ed9731c92134de423edd238c83c4efeac90d0262b445abf114b6b1e30

SHA512
af7014b573c213bfe791a95f9cb645c4886844d8d772873a5efe596562b5826e1ad19ed210f9b60b1623e1f729df8797f4e7a286cbb852a4ed48d2b7a4a2608a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13979.exe

Filesize
468KB

MD5
6a7f611836444ca214c2677dd5f2d10a

SHA1
27aff7254915adb0928ca058d9f3d39fa4afbf09

SHA256
a9e3686d0fb95465a87b365fd2adcf0f87d9daeac315ea675664ca8fcba94177

SHA512
88a6295a3104ab8017e0d0ee127a5c3a14b9bb9e8329e5dc90380d1433220794b478393df20b8239d4ebb66226ea1cea70a27053be2c9ea2bc35c2cce37b4c09

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14908.exe

Filesize
468KB

MD5
4ccb4eb520c29178c6b6a486023a5f8b

SHA1
cfd2d5ef2c2c3b383b2a095df703d10fe09a2312

SHA256
5e5acdc418ddf88a6cc5f281311c689b5981b56be81a6a5ad11769401bce3df7

SHA512
e847457b9500e02ecaa45ec31b7a743ca35d60a46e5f0bd52c3a66e5bcf82df2e67a58a086534f81664529f3e16df4b6db3763195e9c511f9b061523416a820e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15598.exe

Filesize
468KB

MD5
2023fc9268fb74bba0d09a3e48b99afa

SHA1
4e109f460beb39fbceefc56ac4a0ac79d3067c35

SHA256
458c610ac8661a0bb11d7e871e69c1a029220fbaca85d9c2de789b2d3c47dcba

SHA512
a5164cbca56e4ec899f78c2e188e9111ed639b1a6d6a5d7bdc65373706164bc992506c207e96ecfebb0d7956673807507599f5311df119dd69364cf3ca0810bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15677.exe

Filesize
468KB

MD5
6ef3be09f7934c71e8192e6bad831622

SHA1
fa0a1e0dbdb90ae8db947e5e4975b9b12f0290af

SHA256
e075dbdd737cab814ca6d880b7ce4586cf1da011591750ab7525a4593006e843

SHA512
9ff442b9ccf999422dcf75ab21d7013d9a064b02b09b4ccd0b573bbecd1e6156cd9b022c17b3a4b60a837ddd66de063177b8869830d69d6c8888ae83bd37daa9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15869.exe

Filesize
468KB

MD5
f0b9240acaf2a86a99cdcdbdc05ea08f

SHA1
c9777bbe3fee6681bfa668ed119f771a4c02cdf8

SHA256
6fb31ac2cdf8ed42a3295bf3c3ed9ee186882ea96bc76d503831bfc05cd6f580

SHA512
9d95f63d689426ec1650bd63b508373dfdb3b205c84bbb97a964df0a82e30c4e5be611a553c3e8047de46d468e4e7b19a83246c076694d14fdbe0fa1ce7cb126

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16859.exe

Filesize
468KB

MD5
329338acaaac5906827c441e26e2dbfe

SHA1
75fff259cd5bc3fed9e7d78d720499e729d1051a

SHA256
44b7a08cb11b801053d14bb7e90beedf849d626925d8363aa513742ee18a317a

SHA512
a3b22de2ecfede5fef207ae62eb99ae4d9e2df2c986577250861c761771a1eec0a36229212edeba8efd629ff0446bf8aa75f98e77980673179edbeed6513418e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17331.exe

Filesize
468KB

MD5
2cc6148325ff1a11fa38aaa2a3f6262f

SHA1
3b4172ef1c1c1e07d6328d34db3846e3e30115f7

SHA256
9bdee997c7826c2be6867173b4e04b6d52b57c67b90ad04a45b4b03f6acef71d

SHA512
b537427ee6356e2b04916f9cf333a3d1c0017dd728de73fab2f7dcfca8923ad660c3840c6054e28b610feab83a2b112a376b13408e765ce77b291097fd6e9c95

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19438.exe

Filesize
468KB

MD5
9bc54ca5cfdfdc3f7af5e1c6896d57ea

SHA1
326db70cca16767e053e62dbdd9ab8acba0101a2

SHA256
f6789ed571db4cbfafe66ad149a2a5720103508fa994d5ed86f28cd925214a47

SHA512
5d9403bd6aae41319dc065359dd992fe46405bf708e7015f9a3ac6d86931ef8168af428eb3b795601abce18393e1928c52435a6ff55a8cdd51757f743a402bac

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23056.exe

Filesize
468KB

MD5
f360cd97af533a783db4f1997e4e1b78

SHA1
f0b92191cdfb9ffb47deead53b77996cd4e25e06

SHA256
127e4da1fabfe554ed3429ed72dfea74a5f1b00d5345a3f27b6496785af273b3

SHA512
60f978c456661a589f92a9d91b992e1ba50609ff1d426124a2c806afcc7407327ca69afec01cce03a5f204c2c022ac1db31409f6ab11ee52a93bc136a20dcdb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23845.exe

Filesize
468KB

MD5
57bc1bbda38eb992046b5d29fe108a98

SHA1
c923de93b80a14f9e4f599c0b8252d9d493bca80

SHA256
6047348d3af3d42bb20b0b044ed1abd9354ccde2b9c1154ebf08a69a88a3c803

SHA512
883e41980139df66a8ba9da73c01a97ab79187e6f7b049ee5839e0529cfe69b1d99bf4b48f73ef6f61ddb0b708d616dff074e4ba8b2a7e9cbc9830b83201753f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26725.exe

Filesize
468KB

MD5
7437ba92d477885e731b30b609f865fb

SHA1
f3c5ca06c2884e36c06d5109cff14c3a0b7da313

SHA256
a33d87f7cf0c970292ae2d740d63d68daf00e56dd822d17ffa994eb6f2f1e849

SHA512
47baeb6b6a7620d7b8e8ca024df4547197acc3e09fa8c89c6396fcc58c0a2cff9cbc414d0b7776c7ef137099c293a4445272c4ab295bf8722db1601b2f3544e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-295.exe

Filesize
468KB

MD5
2080cb49ecea41d4b6a609c022e42370

SHA1
d22e8272af6162f0480e9d5747f557d5bafda223

SHA256
f3854ae2d9afe79352100edd70ac20366bb176f047915775b24f775464190b79

SHA512
ff25737c0d99b7dd8937d345ee288e83f609c87bf25cfe081172f06033fa84c7334df3975cc2cd733a3d1abdc88dfcdc88178b9cf1f5eea0172b422724d1287e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30210.exe

Filesize
468KB

MD5
3c731c616a5eca80461736fb3317cbcc

SHA1
3b0e88f2304673683a1db07e43147fc9298d8116

SHA256
a79f29bd2722bea81ce1293d2713bc47e278c42e6834afe8ab1d789d5d1e71b9

SHA512
949a5cd68f9b6256d3897f6c63eb0cc059335911cd0d6d07f34675bc1fa4dd73f40c72c5847cd426702eafc6a3b06b9b7e8d21fb649b4d25d5548510af0bee4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34523.exe

Filesize
468KB

MD5
db1b30aea3e0093a6c6a539d33bbaf50

SHA1
d24c43ce8f374fcc202282400e1c2056acbfec32

SHA256
73bf8f6d56b164dfa34530879810be3c7cd37a952a69b954b456a746d778106a

SHA512
69998e7a63364126f0c87a3f0f298e3c4e4e1bf441d493748f7080dfd756ae1ab42c4352460c4eabbb461bafbff9553fc624ae2c51831f673031da21940aace6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36341.exe

Filesize
468KB

MD5
a2c12bc5478c35e0b7ea67186c8bd298

SHA1
e9af3e4e0d9e57e4c29b474758393c774b469f89

SHA256
5bc5f77ef04ee317f9dad0c8f8905bdcf52cecfb7ffebd29546803d32580d06d

SHA512
fbef82dabbb3338f20377ad8b7198c07d5f0209371082ac4c5bd4e94844e76cfdb42f1f488bc9116f4b8d28858ebf60b6a5c3c6f885c0e08c406d2d238c278e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36725.exe

Filesize
468KB

MD5
f259346d0644dca610e9b51ae0665d39

SHA1
c8af1f8496d2d3e0bb7c6c1794a980dc62c037ec

SHA256
6694a389be7d6c34422491c3eeec5ab4f5b88853eace669a0b1d6a7f053c883b

SHA512
f7f94e974d3b727ed68be1ae3c5ad10ce0817039ca4a65b54cc31400a4f5a34c047c391cd0ab937518e5aafcc9d3987f2ff58ff77b4ea27204c06bca7cf67cd1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36989.exe

Filesize
468KB

MD5
1f57fe37bd59569a03242bf2de85406c

SHA1
a335ac660b0229b56c3916ec25a9e5c34c15bb54

SHA256
afb8a9f8de679bcc3fc5e673c29565c45433aa24881f5ba7b63f8d0aa8320c97

SHA512
916daefa2d03f3575106d4cc179ca548cd9f5fb88e71b331c980b5b22ecd20a6f5e7667e1fc97b3b8148b10f0814dae6b9708d98cc06b4363349d4cf5fb36099

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42307.exe

Filesize
468KB

MD5
2ac95dd85122215edf6c0c294ac3fe5b

SHA1
72f30caeca1b39466982352c536a2c55e1f59c36

SHA256
3da70ea105f362796f4995380dde04d28b6035d016c000dfb6493f9afc8a47c7

SHA512
331f051c34762ac7c95d5d1cdd5b82e385b36f689cc87125734ebe0e9e474471e3741e9f75894f404f11f1ee9bc6215312ab185090720ac410e5b51fc9261d7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44244.exe

Filesize
468KB

MD5
6a89f2eac2bcac2d5d619c7605c9b97e

SHA1
c488bc28c8a852fb6b4cda17d42659ed69ce584e

SHA256
0f2492467f309d87e58b8f0d8ec1019610d2145dec429abe87f0dd42c0dc3451

SHA512
573c8a70f597ecaea38636e7919e76816fa639304977aff96d679e7b7459c6bfb2d4345715bb571961706078c1730ccedf8ca4458307c1a1b0a66fd94b84f242

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5095.exe

Filesize
468KB

MD5
36075cde9d7f3b315996a952244883f9

SHA1
54a5bea201921281e4c9bdbbaa41d083ea42a49c

SHA256
11f9b366f71a3bfd17d8735a882375368082a009b19e72e2b065a17258ddcb37

SHA512
db42edcbc21f5a2d7dd8c620fd52e5ebcb93f3edc785b267b778057180124a3498f518a9563c8a77f9c7e106ef76e057fd332682fe1567409ad7d41106856fb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51727.exe

Filesize
468KB

MD5
d2c31e30d17569cb233309134c8b291c

SHA1
8b12caeee85b1c31d19ffb66ff613f31745f7bb5

SHA256
71d685abdfb4fe2cc3299cb899c3293886ab2f039a4a692a88bf6675e94bac58

SHA512
ccbff8f6e39a6f45c1707a71c321b1693d769197c035dd22689f460e52495c70050a5d644de6b96a84e5108c2a6bcba727604bc7c2c925645428cb345b8fb35c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53268.exe

Filesize
468KB

MD5
cc2e70f26d01c605b024ad54ed409a39

SHA1
378c0e60574f17f32805139a789292c9b1f33786

SHA256
abc4da37b21467c24a98c51b8dfe1c3a46483bb7c8378b39a024d1fd68f8e373

SHA512
643cbca71765269bbeae8024fa20e130fba60652409578e16e7ed808450b31586727dc097cf9fd03f78159d03e2b0ee6745700c20b55104d629d84381c7a87d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53320.exe

Filesize
468KB

MD5
e1272a41a9b5d1458fa88fba899a5be8

SHA1
25dc6fa1484f96a3f1592cfd7a1630430c2b9c1b

SHA256
8a97f32d3816489f9747b412a9e575d389d5467f16fc3ec402f90decf3b801c4

SHA512
6649def80421a60d9d78a230d7b1568b5ee6d7bb1a87220a1ade3fd3b2c78842b27c65fa5f2d7b6b263c10abd61eca0da04d04759b3b5184c0c320fd57c9809e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56247.exe

Filesize
468KB

MD5
c7fbfbee807cc1d0b626503f86309a80

SHA1
8b8495ac60c6bfe816d232cee1ab6421767f9c42

SHA256
a94f586fbf023a4a5c4f6cca6e3b7ce9af452aa6586a5154019cc916ae230d9c

SHA512
cb0ea24dfbb790a0228a6be404c9b4cdb95087f1a6837369655b8921bca54a17d9ce2ab03ccc54a9ed82507a4648a39adbf2ee4b2a466b8fa22c4d62b74d0008

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5898.exe

Filesize
468KB

MD5
961ac074474801be7893431fd5c4898f

SHA1
c3097be55c130dde0c6fb2c4edca06d907385113

SHA256
43ef2f9e46114a19576209dbd5df0e91795ace0e28e62b1a60a4133a97882ea7

SHA512
fb3155e9d23304bedc57b4bd328159cc95ebd937d4cd23f9437105354713902105f6f28bd4bfedf022c8e0b6153704685baf25e9ef8cafccefb633bf8ae1522c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63268.exe

Filesize
468KB

MD5
a98682992b36f5fbd388263e2318723c

SHA1
6aab87a8b5d1b40af50c1cb3c0b3530e5ba6ed87

SHA256
0f55cc02ad919a3c53c0ad44c5d73efb4619c7d2f809c6cafbb77278357740f2

SHA512
995393868f63ced04b167939dd8ff81c4a8fe69433d19de9425adf7f130be4ac191993af88e6b390537a3705d056a7e1249e781b4017eaeafb886e2dfb7fd821

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7596.exe

Filesize
468KB

MD5
f9037998b10de20f218b11f5e561354e

SHA1
92ec8d2bdf875717f7281cf273a219953ffea48f

SHA256
b9449bb76ca85498124da5f729cb28c86e29183966ab39683f86df6bd5b30080

SHA512
f2fa3e40eb794d85fba45c5dc9f1b937b5edf556ea839e75ce96f6c077534a9a11a8633005c996ffcee44e4ecf2fbf02c6ab42c34001df2a3034461c801985f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9615.exe

Filesize
468KB

MD5
9f4fdf3b58034b4266edf2cb5d029d1f

SHA1
9017e1d36e11721ce703f8e051df5a48e262e9d4

SHA256
3ae2467e3812ad29bd1817f6de55f8855ea323280642115cb7beb7d34ace9d6c

SHA512
6e86c9db3cb5187dac0a9afa6c456fafd2657b7eb19ccdc4b7c2bffdec19eaa4f72a52b1b670090b9316e1a17ff001651d052498ecfcafe1aeb08dda8c4b2dc1

Download Submit
memory/388-187-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/424-38-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/640-293-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/756-438-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/804-292-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/880-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1244-398-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1268-271-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1272-133-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1328-188-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1448-106-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1472-93-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1568-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1616-229-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1656-239-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1764-329-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1796-290-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1944-328-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1968-319-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2032-317-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2192-19-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2196-47-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2212-279-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2392-95-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2448-60-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2472-397-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2476-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2620-83-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2672-149-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2684-390-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2696-313-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2760-164-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2800-28-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2848-431-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2860-221-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3000-189-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3020-101-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3104-207-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3108-185-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3116-132-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3144-264-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3224-395-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3228-389-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3280-392-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3312-401-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3384-36-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3440-74-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3456-259-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3520-374-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3532-246-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3648-247-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3688-55-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3800-178-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4200-222-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4288-318-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4304-376-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4312-113-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4332-254-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4360-375-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4516-234-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4536-312-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4728-209-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4732-186-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4752-415-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4828-315-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4852-314-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4856-416-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4992-427-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5012-288-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5052-316-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5100-429-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5104-121-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5116-377-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5140-447-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5152-456-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5168-439-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5240-444-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5248-445-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5272-446-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5404-468-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5468-477-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5484-478-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5524-479-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5588-499-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5632-500-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5648-501-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5664-502-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5692-507-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5708-503-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5728-504-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5736-505-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5772-506-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5896-521-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5952-533-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6028-552-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6052-553-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads