3df0aa666d385770d989ae2ba6571e815acd2f639a6a31ac9cb0ba08bea0ae86

Analysis

max time kernel
119s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18/09/2024, 20:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3df0aa666d385770d989ae2ba6571e815acd2f639a6a31ac9cb0ba08bea0ae86N.exe
Size

468KB
MD5

56d81931708a42681b6ab3d87d629b30
SHA1

f08bd2e0109ab1e965592f3bb04af5440d896573
SHA256

3df0aa666d385770d989ae2ba6571e815acd2f639a6a31ac9cb0ba08bea0ae86
SHA512

16ec587c1f96d781c462aa4d2ebc61c77ae39157d3c3961ba27429fae98b6a741a8d48a5f568d460f9b758764e85e1997bb9c37c6553879497f3a249aaf94e4f
SSDEEP

3072:taACogMkjb8yibYfUz54ff8jEC28tICCDmHdbVzDfOC3fQGz2Mll:ta1oKYyiwU14ffuXzlfOwIGz2

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3132	Unicorn-43026.exe
1724	Unicorn-64598.exe
4536	Unicorn-14006.exe
2028	Unicorn-45138.exe
3948	Unicorn-21210.exe
4036	Unicorn-1344.exe
3872	Unicorn-19163.exe
4904	Unicorn-63202.exe
1588	Unicorn-36652.exe
1740	Unicorn-12055.exe
4360	Unicorn-18086.exe
3940	Unicorn-18086.exe
1236	Unicorn-2304.exe
2616	Unicorn-25989.exe
3064	Unicorn-6388.exe
4988	Unicorn-35730.exe
2580	Unicorn-56705.exe
3960	Unicorn-52450.exe
5088	Unicorn-27681.exe
460	Unicorn-21724.exe
4328	Unicorn-60618.exe
4640	Unicorn-59035.exe
4332	Unicorn-48174.exe
5064	Unicorn-46128.exe
2136	Unicorn-11317.exe
4520	Unicorn-24224.exe
4168	Unicorn-35159.exe
3452	Unicorn-44090.exe
3556	Unicorn-32392.exe
652	Unicorn-61386.exe
1640	Unicorn-10794.exe
1872	Unicorn-5963.exe
4196	Unicorn-3917.exe
3240	Unicorn-26960.exe
4468	Unicorn-26960.exe
3124	Unicorn-25376.exe
2756	Unicorn-25376.exe
1480	Unicorn-28906.exe
768	Unicorn-39788.exe
2564	Unicorn-11562.exe
1516	Unicorn-11562.exe
1708	Unicorn-63338.exe
4072	Unicorn-33928.exe
4356	Unicorn-50286.exe
1400	Unicorn-65231.exe
1780	Unicorn-19560.exe
3504	Unicorn-62630.exe
2860	Unicorn-3223.exe
4976	Unicorn-48148.exe
3248	Unicorn-47883.exe
2584	Unicorn-52232.exe
3564	Unicorn-62538.exe
2560	Unicorn-60492.exe
4896	Unicorn-11946.exe
3332	Unicorn-62538.exe
4040	Unicorn-820.exe
4420	Unicorn-45240.exe
1564	Unicorn-19944.exe
4316	Unicorn-26166.exe
3352	Unicorn-56892.exe
2376	Unicorn-41110.exe
1892	Unicorn-64795.exe
4000	Unicorn-28203.exe
4244	Unicorn-45195.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
15976	15324	WerFault.exe	707

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47001.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10618.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27181.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2808.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16264.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57276.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64864.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3789.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44032.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28655.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14702.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33557.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64562.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42881.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6197.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13223.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62782.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27146.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64795.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23228.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58398.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47001.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31213.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27181.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55734.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50726.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36424.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54387.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36580.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42413.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63620.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25376.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25096.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38147.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31210.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46358.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47001.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18516.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13223.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30934.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2611.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4823.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5418.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29254.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65414.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61750.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9694.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46424.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37899.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25507.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37753.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24890.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1937.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19590.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63083.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11831.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3917.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65023.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59689.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58065.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41008.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60660.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23228.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57629.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	2340	dwm.exe
Token: SeChangeNotifyPrivilege	2340	dwm.exe
Token: 33	2340	dwm.exe
Token: SeIncBasePriorityPrivilege	2340	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1148	3df0aa666d385770d989ae2ba6571e815acd2f639a6a31ac9cb0ba08bea0ae86N.exe
3132	Unicorn-43026.exe
1724	Unicorn-64598.exe
4536	Unicorn-14006.exe
4036	Unicorn-1344.exe
2028	Unicorn-45138.exe
3948	Unicorn-21210.exe
3872	Unicorn-19163.exe
4904	Unicorn-63202.exe
1588	Unicorn-36652.exe
3940	Unicorn-18086.exe
1236	Unicorn-2304.exe
2616	Unicorn-25989.exe
4360	Unicorn-18086.exe
1740	Unicorn-12055.exe
3064	Unicorn-6388.exe
4988	Unicorn-35730.exe
2580	Unicorn-56705.exe
3960	Unicorn-52450.exe
5088	Unicorn-27681.exe
460	Unicorn-21724.exe
4328	Unicorn-60618.exe
3452	Unicorn-44090.exe
4640	Unicorn-59035.exe
4168	Unicorn-35159.exe
2136	Unicorn-11317.exe
4332	Unicorn-48174.exe
5064	Unicorn-46128.exe
3556	Unicorn-32392.exe
4520	Unicorn-24224.exe
1640	Unicorn-10794.exe
1872	Unicorn-5963.exe
652	Unicorn-61386.exe
4196	Unicorn-3917.exe
3240	Unicorn-26960.exe
4468	Unicorn-26960.exe
2756	Unicorn-25376.exe
3124	Unicorn-25376.exe
1480	Unicorn-28906.exe
768	Unicorn-39788.exe
1516	Unicorn-11562.exe
2564	Unicorn-11562.exe
1708	Unicorn-63338.exe
4072	Unicorn-33928.exe
1400	Unicorn-65231.exe
4356	Unicorn-50286.exe
1780	Unicorn-19560.exe
2860	Unicorn-3223.exe
3504	Unicorn-62630.exe
4976	Unicorn-48148.exe
4896	Unicorn-11946.exe
2560	Unicorn-60492.exe
2584	Unicorn-52232.exe
3564	Unicorn-62538.exe
4040	Unicorn-820.exe
3248	Unicorn-47883.exe
3332	Unicorn-62538.exe
4244	Unicorn-45195.exe
3352	Unicorn-56892.exe
4000	Unicorn-28203.exe
1892	Unicorn-64795.exe
4316	Unicorn-26166.exe
2376	Unicorn-41110.exe
1564	Unicorn-19944.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1148 wrote to memory of 3132	1148	3df0aa666d385770d989ae2ba6571e815acd2f639a6a31ac9cb0ba08bea0ae86N.exe	84
PID 1148 wrote to memory of 3132	1148	3df0aa666d385770d989ae2ba6571e815acd2f639a6a31ac9cb0ba08bea0ae86N.exe	84
PID 1148 wrote to memory of 3132	1148	3df0aa666d385770d989ae2ba6571e815acd2f639a6a31ac9cb0ba08bea0ae86N.exe	84
PID 3132 wrote to memory of 1724	3132	Unicorn-43026.exe	87
PID 3132 wrote to memory of 1724	3132	Unicorn-43026.exe	87
PID 3132 wrote to memory of 1724	3132	Unicorn-43026.exe	87
PID 1148 wrote to memory of 4536	1148	3df0aa666d385770d989ae2ba6571e815acd2f639a6a31ac9cb0ba08bea0ae86N.exe	88
PID 1148 wrote to memory of 4536	1148	3df0aa666d385770d989ae2ba6571e815acd2f639a6a31ac9cb0ba08bea0ae86N.exe	88
PID 1148 wrote to memory of 4536	1148	3df0aa666d385770d989ae2ba6571e815acd2f639a6a31ac9cb0ba08bea0ae86N.exe	88
PID 1724 wrote to memory of 2028	1724	Unicorn-64598.exe	90
PID 1724 wrote to memory of 2028	1724	Unicorn-64598.exe	90
PID 1724 wrote to memory of 2028	1724	Unicorn-64598.exe	90
PID 4536 wrote to memory of 3948	4536	Unicorn-14006.exe	92
PID 4536 wrote to memory of 3948	4536	Unicorn-14006.exe	92
PID 4536 wrote to memory of 3948	4536	Unicorn-14006.exe	92
PID 3132 wrote to memory of 4036	3132	Unicorn-43026.exe	91
PID 3132 wrote to memory of 4036	3132	Unicorn-43026.exe	91
PID 3132 wrote to memory of 4036	3132	Unicorn-43026.exe	91
PID 1148 wrote to memory of 3872	1148	3df0aa666d385770d989ae2ba6571e815acd2f639a6a31ac9cb0ba08bea0ae86N.exe	94
PID 1148 wrote to memory of 3872	1148	3df0aa666d385770d989ae2ba6571e815acd2f639a6a31ac9cb0ba08bea0ae86N.exe	94
PID 1148 wrote to memory of 3872	1148	3df0aa666d385770d989ae2ba6571e815acd2f639a6a31ac9cb0ba08bea0ae86N.exe	94
PID 4036 wrote to memory of 4904	4036	Unicorn-1344.exe	96
PID 4036 wrote to memory of 4904	4036	Unicorn-1344.exe	96
PID 4036 wrote to memory of 4904	4036	Unicorn-1344.exe	96
PID 3132 wrote to memory of 1588	3132	Unicorn-43026.exe	97
PID 3132 wrote to memory of 1588	3132	Unicorn-43026.exe	97
PID 3132 wrote to memory of 1588	3132	Unicorn-43026.exe	97
PID 3948 wrote to memory of 1740	3948	Unicorn-21210.exe	98
PID 3948 wrote to memory of 1740	3948	Unicorn-21210.exe	98
PID 3948 wrote to memory of 1740	3948	Unicorn-21210.exe	98
PID 2028 wrote to memory of 4360	2028	Unicorn-45138.exe	100
PID 2028 wrote to memory of 4360	2028	Unicorn-45138.exe	100
PID 2028 wrote to memory of 4360	2028	Unicorn-45138.exe	100
PID 3872 wrote to memory of 3940	3872	Unicorn-19163.exe	99
PID 3872 wrote to memory of 3940	3872	Unicorn-19163.exe	99
PID 3872 wrote to memory of 3940	3872	Unicorn-19163.exe	99
PID 4536 wrote to memory of 1236	4536	Unicorn-14006.exe	101
PID 4536 wrote to memory of 1236	4536	Unicorn-14006.exe	101
PID 4536 wrote to memory of 1236	4536	Unicorn-14006.exe	101
PID 1148 wrote to memory of 2616	1148	3df0aa666d385770d989ae2ba6571e815acd2f639a6a31ac9cb0ba08bea0ae86N.exe	102
PID 1148 wrote to memory of 2616	1148	3df0aa666d385770d989ae2ba6571e815acd2f639a6a31ac9cb0ba08bea0ae86N.exe	102
PID 1148 wrote to memory of 2616	1148	3df0aa666d385770d989ae2ba6571e815acd2f639a6a31ac9cb0ba08bea0ae86N.exe	102
PID 1724 wrote to memory of 3064	1724	Unicorn-64598.exe	103
PID 1724 wrote to memory of 3064	1724	Unicorn-64598.exe	103
PID 1724 wrote to memory of 3064	1724	Unicorn-64598.exe	103
PID 4904 wrote to memory of 4988	4904	Unicorn-63202.exe	104
PID 4904 wrote to memory of 4988	4904	Unicorn-63202.exe	104
PID 4904 wrote to memory of 4988	4904	Unicorn-63202.exe	104
PID 4036 wrote to memory of 2580	4036	Unicorn-1344.exe	105
PID 4036 wrote to memory of 2580	4036	Unicorn-1344.exe	105
PID 4036 wrote to memory of 2580	4036	Unicorn-1344.exe	105
PID 1588 wrote to memory of 3960	1588	Unicorn-36652.exe	106
PID 1588 wrote to memory of 3960	1588	Unicorn-36652.exe	106
PID 1588 wrote to memory of 3960	1588	Unicorn-36652.exe	106
PID 3132 wrote to memory of 5088	3132	Unicorn-43026.exe	107
PID 3132 wrote to memory of 5088	3132	Unicorn-43026.exe	107
PID 3132 wrote to memory of 5088	3132	Unicorn-43026.exe	107
PID 3940 wrote to memory of 460	3940	Unicorn-18086.exe	108
PID 3940 wrote to memory of 460	3940	Unicorn-18086.exe	108
PID 3940 wrote to memory of 460	3940	Unicorn-18086.exe	108
PID 2616 wrote to memory of 4328	2616	Unicorn-25989.exe	109
PID 2616 wrote to memory of 4328	2616	Unicorn-25989.exe	109
PID 2616 wrote to memory of 4328	2616	Unicorn-25989.exe	109
PID 3064 wrote to memory of 4332	3064	Unicorn-6388.exe	113

C:\Users\Admin\AppData\Local\Temp\3df0aa666d385770d989ae2ba6571e815acd2f639a6a31ac9cb0ba08bea0ae86N.exe
"C:\Users\Admin\AppData\Local\Temp\3df0aa666d385770d989ae2ba6571e815acd2f639a6a31ac9cb0ba08bea0ae86N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Users\Admin\AppData\Local\Temp\Unicorn-43026.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-43026.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64598.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64598.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45138.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18086.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25376.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65444.exe
        7⤵
        
        PID:1260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51028.exe
        8⤵
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39866.exe
        9⤵
        
        PID:7956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30192.exe
        9⤵
        
        PID:11240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6289.exe
        9⤵
        
        PID:14564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32872.exe
        9⤵
        
        PID:7876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47795.exe
        8⤵
        
        PID:7256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26029.exe
        8⤵
        
        PID:12184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35289.exe
        8⤵
        
        PID:15792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49138.exe
        8⤵
        
        PID:8888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37732.exe
        7⤵
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30520.exe
        8⤵
        
        PID:7680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58973.exe
        8⤵
        
        PID:11872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3083.exe
        8⤵
        
        PID:15788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9367.exe
        8⤵
        
        PID:4016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
        7⤵
        
        PID:8840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8542.exe
        7⤵
        
        PID:12516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25703.exe
        7⤵
        
        PID:5648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34617.exe
        6⤵
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51028.exe
        7⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33862.exe
        8⤵
        
        PID:7020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1329.exe
        9⤵
        
        PID:9052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13446.exe
        9⤵
        
        PID:12628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27873.exe
        9⤵
        
        PID:9116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62507.exe
        8⤵
        
        PID:9408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3829.exe
        8⤵
        
        PID:13564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43482.exe
        8⤵
        
        PID:4628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16902.exe
        7⤵
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44822.exe
        8⤵
        
        PID:10496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38464.exe
        8⤵
        
        PID:12656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19167.exe
        8⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58536.exe
        7⤵
        
        PID:9608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17111.exe
        7⤵
        
        PID:13304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14017.exe
        7⤵
        
        PID:8276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12216.exe
        6⤵
        
        PID:5596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9715.exe
        7⤵
        
        PID:5944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23970.exe
        7⤵
        
        PID:10544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16211.exe
        7⤵
        
        PID:15332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22566.exe
        7⤵
        
        PID:16484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1937.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52771.exe
        6⤵
        
        PID:6612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18945.exe
        6⤵
        
        PID:15604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24423.exe
        6⤵
        
        PID:2824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32392.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29434.exe
        6⤵
        
        PID:2308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20458.exe
        7⤵
        
        PID:6136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48034.exe
        8⤵
        
        PID:8048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56088.exe
        9⤵
        
        PID:10764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2476.exe
        9⤵
        
        PID:15108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21335.exe
        9⤵
        
        PID:12088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27146.exe
        9⤵
        
        PID:1868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18437.exe
        8⤵
        
        PID:11660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27146.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31955.exe
        7⤵
        
        PID:8996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33047.exe
        7⤵
        
        PID:12600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10929.exe
        7⤵
        
        PID:3360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64680.exe
        6⤵
        
        PID:6880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34386.exe
        7⤵
        
        PID:8460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54671.exe
        7⤵
        
        PID:13096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64864.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55807.exe
        6⤵
        
        PID:14872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40702.exe
        6⤵
        
        PID:3868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60492.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23618.exe
        6⤵
        
        PID:5356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62258.exe
        7⤵
        
        PID:6464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27972.exe
        8⤵
        
        PID:9196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42082.exe
        9⤵
        
        PID:11668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23326.exe
        9⤵
        
        PID:16208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54095.exe
        8⤵
        
        PID:9876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6767.exe
        8⤵
        
        PID:16400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42086.exe
        7⤵
        
        PID:8380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52454.exe
        7⤵
        
        PID:12992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15963.exe
        7⤵
        
        PID:16464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9039.exe
        6⤵
        
        PID:7480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24890.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53985.exe
        7⤵
        
        PID:6388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59523.exe
        6⤵
        
        PID:10416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23333.exe
        6⤵
        
        PID:15344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37494.exe
        6⤵
        
        PID:7632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54847.exe
        5⤵
        
        PID:6108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38522.exe
        6⤵
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57629.exe
        7⤵
        
        PID:10816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48508.exe
        7⤵
        
        PID:3528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35056.exe
        7⤵
        
        PID:7700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63083.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38988.exe
        6⤵
        
        PID:14288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31272.exe
        6⤵
        
        PID:1036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55056.exe
        5⤵
        
        PID:7332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10805.exe
        6⤵
        
        PID:9240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30934.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20428.exe
        6⤵
        
        PID:5692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21302.exe
        5⤵
        
        PID:10792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29318.exe
        5⤵
        
        PID:14528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65096.exe
        5⤵
        
        PID:2084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6388.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6388.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48174.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62538.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51630.exe
        7⤵
        
        PID:5208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44360.exe
        8⤵
        
        PID:6776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40546.exe
        9⤵
        
        PID:10768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17852.exe
        9⤵
        
        PID:14536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36335.exe
        9⤵
        
        PID:15852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63215.exe
        9⤵
        
        PID:15844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23612.exe
        8⤵
        
        PID:9320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57114.exe
        8⤵
        
        PID:13504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16264.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17478.exe
        7⤵
        
        PID:7204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45616.exe
        8⤵
        
        PID:9264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37348.exe
        8⤵
        
        PID:13408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19167.exe
        8⤵
        
        PID:792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12049.exe
        7⤵
        
        PID:10512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58065.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16264.exe
        7⤵
        
        PID:3832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1998.exe
        6⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36550.exe
        7⤵
        
        PID:7652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20078.exe
        7⤵
        
        PID:11796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48292.exe
        6⤵
        
        PID:8320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7582.exe
        6⤵
        
        PID:12216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11946.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31210.exe
        6⤵
        
        PID:5304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44360.exe
        7⤵
        
        PID:6768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21112.exe
        8⤵
        
        PID:7276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42881.exe
        8⤵
        
        PID:14372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37753.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23612.exe
        7⤵
        
        PID:9364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57114.exe
        7⤵
        
        PID:13496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15963.exe
        7⤵
        
        PID:5516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9310.exe
        6⤵
        
        PID:7344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59020.exe
        7⤵
        
        PID:10604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30296.exe
        7⤵
        
        PID:14000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22796.exe
        7⤵
        
        PID:16036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39268.exe
        6⤵
        
        PID:10908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40167.exe
        6⤵
        
        PID:14340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48485.exe
        6⤵
        
        PID:3720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15733.exe
        5⤵
        
        PID:5948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3851.exe
        6⤵
        
        PID:6864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52725.exe
        6⤵
        
        PID:12916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41266.exe
        6⤵
        
        PID:15964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31611.exe
        6⤵
        
        PID:664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47935.exe
        5⤵
        
        PID:8304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64454.exe
        5⤵
        
        PID:11768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29903.exe
        5⤵
        
        PID:6164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11317.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11317.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3223.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-705.exe
        6⤵
        
        PID:6584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24874.exe
        7⤵
        
        PID:8092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26876.exe
        7⤵
        
        PID:11952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52403.exe
        6⤵
        
        PID:8764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65414.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40702.exe
        6⤵
        
        PID:15028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1998.exe
        5⤵
        
        PID:5932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25668.exe
        6⤵
        
        PID:7940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10805.exe
        7⤵
        
        PID:6380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-208.exe
        7⤵
        
        PID:13920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19167.exe
        7⤵
        
        PID:5228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26902.exe
        6⤵
        
        PID:10784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31587.exe
        6⤵
        
        PID:14552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7408.exe
        6⤵
        
        PID:10404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55500.exe
        5⤵
        
        PID:7044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5828.exe
        5⤵
        
        PID:9392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44906.exe
        5⤵
        
        PID:15860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21050.exe
        5⤵
        
        PID:16424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47883.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47883.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31210.exe
        5⤵
        
        PID:5296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44360.exe
        6⤵
        
        PID:6704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61158.exe
        7⤵
        
        PID:10408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52279.exe
        7⤵
        
        PID:13996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51884.exe
        7⤵
        
        PID:3456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42086.exe
        6⤵
        
        PID:8864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15086.exe
        6⤵
        
        PID:14224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14017.exe
        6⤵
        
        PID:8040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21562.exe
        5⤵
        
        PID:7240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45874.exe
        6⤵
        
        PID:10872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22076.exe
        6⤵
        
        PID:14992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26954.exe
        6⤵
        
        PID:7576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55028.exe
        5⤵
        
        PID:10424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47838.exe
        5⤵
        
        PID:14032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50623.exe
        5⤵
        
        PID:3964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61750.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61750.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40276.exe
        5⤵
        
        PID:6672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18652.exe
        6⤵
        
        PID:6496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51765.exe
        6⤵
        
        PID:6384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15963.exe
        6⤵
        
        PID:15820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8682.exe
        5⤵
        
        PID:8000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50058.exe
        6⤵
        
        PID:11180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58091.exe
        6⤵
        
        PID:14776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9937.exe
        6⤵
        
        PID:8920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50726.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21619.exe
        5⤵
        
        PID:7416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35806.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35806.exe
      4⤵
      PID:6544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39202.exe
        5⤵
        
        PID:9640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51355.exe
        5⤵
        
        PID:13828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59624.exe
        5⤵
        
        PID:16132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3941.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3941.exe
      4⤵
      PID:11200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51341.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51341.exe
      4⤵
      PID:14864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63643.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63643.exe
      4⤵
      PID:15628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30919.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30919.exe
      4⤵
      PID:5052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27702.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27702.exe
      4⤵
      PID:8736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1344.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1344.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63202.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63202.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35730.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61386.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56892.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56098.exe
        8⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64972.exe
        9⤵
        
        PID:7128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60660.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:14928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46302.exe
        10⤵
        
        PID:2020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61329.exe
        9⤵
        
        PID:10072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-477.exe
        9⤵
        
        PID:14232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54170.exe
        9⤵
        
        PID:10980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9502.exe
        8⤵
        
        PID:7720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11651.exe
        9⤵
        
        PID:14816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15282.exe
        9⤵
        
        PID:5104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9117.exe
        8⤵
        
        PID:11232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12154.exe
        8⤵
        
        PID:14796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10467.exe
        8⤵
        
        PID:9104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53337.exe
        7⤵
        
        PID:5868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29752.exe
        8⤵
        
        PID:8096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62211.exe
        8⤵
        
        PID:12880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26954.exe
        8⤵
        
        PID:7828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59584.exe
        7⤵
        
        PID:6640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7390.exe
        7⤵
        
        PID:12008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26623.exe
        7⤵
        
        PID:15828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23565.exe
        7⤵
        
        PID:5276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41110.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46560.exe
        7⤵
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13223.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17338.exe
        9⤵
        
        PID:10020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23970.exe
        8⤵
        
        PID:10580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16211.exe
        8⤵
        
        PID:13760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14017.exe
        8⤵
        
        PID:4504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17068.exe
        7⤵
        
        PID:7200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61224.exe
        7⤵
        
        PID:11916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50063.exe
        7⤵
        
        PID:16148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16264.exe
        7⤵
        
        PID:2768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4213.exe
        6⤵
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61630.exe
        7⤵
        
        PID:7116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55849.exe
        7⤵
        
        PID:10044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14458.exe
        7⤵
        
        PID:15700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15963.exe
        7⤵
        
        PID:2212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25761.exe
        6⤵
        
        PID:8776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65414.exe
        6⤵
        
        PID:12508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12882.exe
        6⤵
        
        PID:5336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10794.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1230.exe
        6⤵
        
        PID:1372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35424.exe
        7⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47001.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27181.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54089.exe
        8⤵
        
        PID:2640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40970.exe
        7⤵
        
        PID:8848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27181.exe
        7⤵
        
        PID:12564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31230.exe
        7⤵
        
        PID:5616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48920.exe
        6⤵
        
        PID:7156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10011.exe
        7⤵
        
        PID:10548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28655.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33557.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8786.exe
        6⤵
        
        PID:9776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14205.exe
        6⤵
        
        PID:12664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5958.exe
        6⤵
        
        PID:3864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28203.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25096.exe
        6⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6337.exe
        7⤵
        
        PID:8660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26082.exe
        7⤵
        
        PID:13112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32905.exe
        7⤵
        
        PID:15924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49938.exe
        7⤵
        
        PID:5016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36964.exe
        6⤵
        
        PID:9028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37899.exe
        6⤵
        
        PID:12356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49138.exe
        6⤵
        
        PID:9172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32637.exe
        5⤵
        
        PID:6044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32658.exe
        6⤵
        
        PID:7308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20078.exe
        6⤵
        
        PID:11788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21619.exe
        6⤵
        
        PID:7788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55606.exe
        5⤵
        
        PID:8384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65023.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38269.exe
        5⤵
        
        PID:16032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38513.exe
        5⤵
        
        PID:5392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56705.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56705.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5963.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26166.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21864.exe
        7⤵
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19446.exe
        8⤵
        
        PID:8028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30192.exe
        8⤵
        
        PID:11252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6289.exe
        8⤵
        
        PID:14980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18482.exe
        8⤵
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60047.exe
        7⤵
        
        PID:7728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30497.exe
        7⤵
        
        PID:12076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50063.exe
        7⤵
        
        PID:16156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6342.exe
        7⤵
        
        PID:5660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17809.exe
        6⤵
        
        PID:6728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31226.exe
        7⤵
        
        PID:8992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22958.exe
        7⤵
        
        PID:13380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58939.exe
        7⤵
        
        PID:5748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43213.exe
        6⤵
        
        PID:9344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58398.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27272.exe
        6⤵
        
        PID:15856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45195.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25096.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12751.exe
        7⤵
        
        PID:9448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55631.exe
        7⤵
        
        PID:13572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11728.exe
        7⤵
        
        PID:5612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36964.exe
        6⤵
        
        PID:8972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3088.exe
        6⤵
        
        PID:12384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23757.exe
        6⤵
        
        PID:2944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48406.exe
        5⤵
        
        PID:5996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59134.exe
        6⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10805.exe
        7⤵
        
        PID:7608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37348.exe
        7⤵
        
        PID:13440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63368.exe
        7⤵
        
        PID:10484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25558.exe
        6⤵
        
        PID:9520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65090.exe
        6⤵
        
        PID:14036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36503.exe
        5⤵
        
        PID:7144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57868.exe
        6⤵
        
        PID:8236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65361.exe
        6⤵
        
        PID:13004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49626.exe
        6⤵
        
        PID:16344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37494.exe
        6⤵
        
        PID:16412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55736.exe
        5⤵
        
        PID:9416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17641.exe
        5⤵
        
        PID:14516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56713.exe
        5⤵
        
        PID:16456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3917.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3917.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19944.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14427.exe
        6⤵
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34604.exe
        7⤵
        
        PID:7540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20078.exe
        7⤵
        
        PID:11812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16264.exe
        7⤵
        
        PID:2496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15890.exe
        6⤵
        
        PID:8404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-320.exe
        7⤵
        
        PID:7432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18821.exe
        6⤵
        
        PID:11880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22185.exe
        6⤵
        
        PID:16492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30524.exe
        5⤵
        
        PID:6996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55730.exe
        6⤵
        
        PID:9436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55631.exe
        6⤵
        
        PID:13584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37348.exe
        5⤵
        
        PID:9328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5610.exe
        5⤵
        
        PID:13540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42413.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64795.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64795.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21864.exe
        5⤵
        
        PID:5956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19446.exe
        6⤵
        
        PID:8152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34874.exe
        7⤵
        
        PID:12248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23970.exe
        6⤵
        
        PID:9612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12127.exe
        6⤵
        
        PID:15376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27358.exe
        6⤵
        
        PID:16024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9367.exe
        6⤵
        
        PID:5136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23787.exe
        5⤵
        
        PID:9212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59689.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46634.exe
        5⤵
        
        PID:15740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20729.exe
        5⤵
        
        PID:15720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30193.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30193.exe
      4⤵
      PID:5700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48034.exe
        5⤵
        
        PID:8056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30192.exe
        5⤵
        
        PID:11220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6289.exe
        5⤵
        
        PID:15044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55002.exe
        5⤵
        
        PID:2212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20428.exe
        5⤵
        
        PID:5664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11468.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11468.exe
      4⤵
      PID:7188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44372.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44372.exe
      4⤵
      PID:12080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5623.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5623.exe
      4⤵
      PID:15780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21241.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21241.exe
      4⤵
      PID:16504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36652.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36652.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52450.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26960.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59414.exe
        6⤵
        
        PID:1924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7665.exe
        7⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7769.exe
        8⤵
        
        PID:8172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62211.exe
        8⤵
        
        PID:13068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54037.exe
        8⤵
        
        PID:16212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49138.exe
        8⤵
        
        PID:8868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50509.exe
        7⤵
        
        PID:7552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62786.exe
        7⤵
        
        PID:12252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56940.exe
        7⤵
        
        PID:15648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20664.exe
        6⤵
        
        PID:804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36462.exe
        7⤵
        
        PID:10752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38272.exe
        7⤵
        
        PID:14428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48370.exe
        7⤵
        
        PID:4964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62874.exe
        6⤵
        
        PID:8796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37323.exe
        6⤵
        
        PID:12400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14828.exe
        6⤵
        
        PID:14988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53747.exe
        5⤵
        
        PID:4616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32710.exe
        6⤵
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47001.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27181.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39398.exe
        7⤵
        
        PID:5168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59445.exe
        6⤵
        
        PID:8568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2101.exe
        6⤵
        
        PID:12316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5958.exe
        6⤵
        
        PID:2664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40971.exe
        5⤵
        
        PID:7392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46582.exe
        5⤵
        
        PID:11052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14966.exe
        5⤵
        
        PID:13468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40702.exe
        5⤵
        
        PID:7668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11562.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11562.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37240.exe
        5⤵
        
        PID:1976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26680.exe
        6⤵
        
        PID:5204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44526.exe
        7⤵
        
        PID:6824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18948.exe
        8⤵
        
        PID:9560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12398.exe
        8⤵
        
        PID:15324
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15324 -s 472
        9⤵
        Program crash
        
        PID:15976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58939.exe
        8⤵
        
        PID:8928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30192.exe
        7⤵
        
        PID:11208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6289.exe
        7⤵
        
        PID:14800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1141.exe
        7⤵
        
        PID:15696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46302.exe
        7⤵
        
        PID:4384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56539.exe
        6⤵
        
        PID:7884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32250.exe
        7⤵
        
        PID:2092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65500.exe
        6⤵
        
        PID:9884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32435.exe
        6⤵
        
        PID:15668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38147.exe
        6⤵
        
        PID:6324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55029.exe
        5⤵
        
        PID:6968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27972.exe
        6⤵
        
        PID:9032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54479.exe
        6⤵
        
        PID:12480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10467.exe
        6⤵
        
        PID:9108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10705.exe
        5⤵
        
        PID:9420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9694.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6413.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6413.exe
      4⤵
      PID:4396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16758.exe
        5⤵
        
        PID:6240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57629.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52008.exe
        6⤵
        
        PID:14440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16264.exe
        6⤵
        
        PID:4080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36056.exe
        5⤵
        
        PID:6216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64706.exe
        5⤵
        
        PID:12840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43482.exe
        5⤵
        
        PID:3448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11998.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11998.exe
      4⤵
      PID:6740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57868.exe
        5⤵
        
        PID:8628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42881.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57874.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57874.exe
      4⤵
      PID:10024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56736.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56736.exe
      4⤵
      PID:1272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27681.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27681.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26960.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26960.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59414.exe
        5⤵
        
        PID:2208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20302.exe
        6⤵
        
        PID:6072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38304.exe
        7⤵
        
        PID:7268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41008.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12737.exe
        8⤵
        
        PID:16168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42828.exe
        7⤵
        
        PID:11312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43482.exe
        7⤵
        
        PID:14848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19590.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6185.exe
        6⤵
        
        PID:11328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32435.exe
        6⤵
        
        PID:15692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38147.exe
        6⤵
        
        PID:6328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45361.exe
        5⤵
        
        PID:2100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7961.exe
        6⤵
        
        PID:7768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34018.exe
        7⤵
        
        PID:15008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4972.exe
        7⤵
        
        PID:15712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46878.exe
        7⤵
        
        PID:4760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16570.exe
        6⤵
        
        PID:11904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29625.exe
        5⤵
        
        PID:8412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10759.exe
        5⤵
        
        PID:13052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18912.exe
        5⤵
        
        PID:15780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31188.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31188.exe
      4⤵
      PID:2484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54536.exe
        5⤵
        
        PID:6004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-971.exe
        6⤵
        
        PID:7968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38408.exe
        7⤵
        
        PID:10996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61407.exe
        7⤵
        
        PID:14840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48485.exe
        7⤵
        
        PID:7420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62211.exe
        6⤵
        
        PID:12864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46634.exe
        6⤵
        
        PID:15824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15278.exe
        6⤵
        
        PID:8740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31955.exe
        5⤵
        
        PID:9004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8542.exe
        5⤵
        
        PID:12496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23757.exe
        5⤵
        
        PID:4852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49330.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49330.exe
      4⤵
      PID:5792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47001.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6197.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7611.exe
        6⤵
        
        PID:6012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27181.exe
        5⤵
        
        PID:12592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6342.exe
        5⤵
        
        PID:6540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36067.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36067.exe
      4⤵
      PID:8528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42472.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42472.exe
      4⤵
      PID:12124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50683.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50683.exe
      4⤵
      PID:7616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63338.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63338.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12543.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12543.exe
      4⤵
      PID:4280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12865.exe
        5⤵
        
        PID:5500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57676.exe
        6⤵
        
        PID:9464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-400.exe
        6⤵
        
        PID:13604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48485.exe
        6⤵
        
        PID:15612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2808.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44132.exe
        6⤵
        
        PID:15256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51851.exe
        6⤵
        
        PID:5896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7529.exe
        5⤵
        
        PID:12708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14702.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59689.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59689.exe
      4⤵
      PID:7108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23800.exe
        5⤵
        
        PID:11564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65013.exe
        5⤵
        
        PID:5320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39294.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39294.exe
      4⤵
      PID:9532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5418.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5418.exe
      4⤵
      PID:14008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22185.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22185.exe
      4⤵
      PID:944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30056.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30056.exe
    3⤵
    PID:2012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49238.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49238.exe
      4⤵
      PID:808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61630.exe
        5⤵
        
        PID:7036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53327.exe
        5⤵
        
        PID:12020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22185.exe
        5⤵
        
        PID:5188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32226.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32226.exe
      4⤵
      PID:8488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49400.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49400.exe
      4⤵
      PID:13104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38147.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38147.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:16236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-957.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-957.exe
    3⤵
    PID:6908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57136.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57136.exe
      4⤵
      PID:8072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36580.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36580.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50752.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50752.exe
      4⤵
      PID:15676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19167.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19167.exe
      4⤵
      PID:6528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54387.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54387.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:9564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35954.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35954.exe
    3⤵
    PID:13820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27079.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27079.exe
    3⤵
    PID:5888
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14006.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14006.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21210.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21210.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12055.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12055.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25376.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38562.exe
        6⤵
        
        PID:5476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20113.exe
        7⤵
        
        PID:1256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2611.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10467.exe
        8⤵
        
        PID:6416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6430.exe
        7⤵
        
        PID:3680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29879.exe
        7⤵
        
        PID:5704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65448.exe
        6⤵
        
        PID:6104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40110.exe
        7⤵
        
        PID:2612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20428.exe
        7⤵
        
        PID:8676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25507.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63214.exe
        6⤵
        
        PID:13764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52930.exe
        6⤵
        
        PID:1216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34617.exe
        5⤵
        
        PID:4240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32710.exe
        6⤵
        
        PID:3264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13799.exe
        7⤵
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21278.exe
        8⤵
        
        PID:10712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37286.exe
        8⤵
        
        PID:15188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47978.exe
        8⤵
        
        PID:15540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41142.exe
        8⤵
        
        PID:15720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52911.exe
        8⤵
        
        PID:16388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30192.exe
        7⤵
        
        PID:11248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6289.exe
        7⤵
        
        PID:14848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20729.exe
        7⤵
        
        PID:2548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1308.exe
        6⤵
        
        PID:7952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65500.exe
        6⤵
        
        PID:10004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53571.exe
        6⤵
        
        PID:15868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62206.exe
        6⤵
        
        PID:15108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49138.exe
        6⤵
        
        PID:632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9092.exe
        5⤵
        
        PID:6960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57624.exe
        6⤵
        
        PID:11688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9851.exe
        5⤵
        
        PID:9580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45754.exe
        5⤵
        
        PID:13868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59035.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59035.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19560.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63643.exe
        6⤵
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45616.exe
        7⤵
        
        PID:9296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12652.exe
        7⤵
        
        PID:13480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43824.exe
        6⤵
        
        PID:8476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7966.exe
        6⤵
        
        PID:12324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18144.exe
        6⤵
        
        PID:2776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36424.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58750.exe
        6⤵
        
        PID:6760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10805.exe
        7⤵
        
        PID:8112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37348.exe
        7⤵
        
        PID:13424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49938.exe
        7⤵
        
        PID:1860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23612.exe
        6⤵
        
        PID:9356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61198.exe
        6⤵
        
        PID:13684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27489.exe
        6⤵
        
        PID:1152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4187.exe
        5⤵
        
        PID:6684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23800.exe
        6⤵
        
        PID:11524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50623.exe
        6⤵
        
        PID:15116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15392.exe
        5⤵
        
        PID:10048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63214.exe
        5⤵
        
        PID:14228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26644.exe
        5⤵
        
        PID:15880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62630.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62630.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10981.exe
        5⤵
        
        PID:220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34054.exe
        6⤵
        
        PID:6808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32378.exe
        7⤵
        
        PID:10616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28655.exe
        7⤵
        
        PID:14996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37494.exe
        7⤵
        
        PID:472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42086.exe
        6⤵
        
        PID:3128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15086.exe
        6⤵
        
        PID:13404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30095.exe
        6⤵
        
        PID:15388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15340.exe
        5⤵
        
        PID:7364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61952.exe
        6⤵
        
        PID:8692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9221.exe
        6⤵
        
        PID:13776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15444.exe
        6⤵
        
        PID:15108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6342.exe
        6⤵
        
        PID:5752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32469.exe
        5⤵
        
        PID:10456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32793.exe
        5⤵
        
        PID:14300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4823.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26861.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26861.exe
      4⤵
      PID:5240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19856.exe
        5⤵
        
        PID:6696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61630.exe
        6⤵
        
        PID:6896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31841.exe
        6⤵
        
        PID:12796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41837.exe
        6⤵
        
        PID:16020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40970.exe
        5⤵
        
        PID:8944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27181.exe
        5⤵
        
        PID:12556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43482.exe
        5⤵
        
        PID:324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46888.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46888.exe
      4⤵
      PID:7280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61760.exe
        5⤵
        
        PID:9484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47924.exe
        5⤵
        
        PID:14408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27358.exe
        5⤵
        
        PID:1128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38147.exe
        5⤵
        
        PID:3320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52413.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52413.exe
      4⤵
      PID:9472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33786.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33786.exe
      4⤵
      PID:15100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47284.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47284.exe
      4⤵
      PID:5592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2304.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2304.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44090.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44090.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50286.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41708.exe
        6⤵
        
        PID:4920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16758.exe
        7⤵
        
        PID:6248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34194.exe
        8⤵
        
        PID:8820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20868.exe
        9⤵
        
        PID:11992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34382.exe
        9⤵
        
        PID:1676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48485.exe
        9⤵
        
        PID:7792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42226.exe
        8⤵
        
        PID:12456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29092.exe
        8⤵
        
        PID:6232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42086.exe
        7⤵
        
        PID:8728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15086.exe
        7⤵
        
        PID:13808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36502.exe
        7⤵
        
        PID:2556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15453.exe
        6⤵
        
        PID:7888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29254.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14743.exe
        7⤵
        
        PID:5756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15637.exe
        6⤵
        
        PID:11600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54767.exe
        6⤵
        
        PID:16476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7260.exe
        5⤵
        
        PID:5252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13633.exe
        6⤵
        
        PID:6788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57868.exe
        7⤵
        
        PID:9232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37348.exe
        7⤵
        
        PID:13416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43863.exe
        7⤵
        
        PID:5132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23612.exe
        6⤵
        
        PID:9372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61198.exe
        6⤵
        
        PID:13520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54473.exe
        6⤵
        
        PID:6132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20907.exe
        5⤵
        
        PID:7376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55247.exe
        5⤵
        
        PID:11092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7573.exe
        5⤵
        
        PID:14880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22870.exe
        5⤵
        
        PID:7704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65231.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65231.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41708.exe
        5⤵
        
        PID:3068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31340.exe
        6⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21112.exe
        7⤵
        
        PID:7304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52200.exe
        7⤵
        
        PID:13560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6342.exe
        7⤵
        
        PID:6568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23228.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10426.exe
        6⤵
        
        PID:13880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54089.exe
        6⤵
        
        PID:752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35184.exe
        5⤵
        
        PID:7148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4583.exe
        6⤵
        
        PID:5012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37348.exe
        6⤵
        
        PID:13696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48485.exe
        6⤵
        
        PID:6800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39294.exe
        5⤵
        
        PID:9540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5418.exe
        5⤵
        
        PID:13900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31230.exe
        5⤵
        
        PID:1644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20995.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20995.exe
      4⤵
      PID:5232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23940.exe
        5⤵
        
        PID:6748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8428.exe
        6⤵
        
        PID:10528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44032.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37494.exe
        6⤵
        
        PID:8664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42086.exe
        5⤵
        
        PID:8716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15086.exe
        5⤵
        
        PID:440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29092.exe
        5⤵
        
        PID:5052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37079.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37079.exe
      4⤵
      PID:7212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21500.exe
        5⤵
        
        PID:15672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42418.exe
        5⤵
        
        PID:16096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29966.exe
        5⤵
        
        PID:15952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-505.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-505.exe
      4⤵
      PID:10252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60820.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60820.exe
      4⤵
      PID:7784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46128.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46128.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48148.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48148.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27126.exe
        5⤵
        
        PID:5260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5226.exe
        6⤵
        
        PID:7316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18482.exe
        7⤵
        
        PID:908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53658.exe
        6⤵
        
        PID:7928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31999.exe
        6⤵
        
        PID:15312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26650.exe
        6⤵
        
        PID:16444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32365.exe
        5⤵
        
        PID:8128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1537.exe
        6⤵
        
        PID:13000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43571.exe
        5⤵
        
        PID:10520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42192.exe
        5⤵
        
        PID:15036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26011.exe
        5⤵
        
        PID:6168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38562.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38562.exe
      4⤵
      PID:5484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20113.exe
        5⤵
        
        PID:6652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23564.exe
        6⤵
        
        PID:1208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10706.exe
        5⤵
        
        PID:11168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25603.exe
        5⤵
        
        PID:8812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31213.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31213.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10467.exe
        5⤵
        
        PID:6128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59523.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59523.exe
      4⤵
      PID:9252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23333.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23333.exe
      4⤵
      PID:15336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41837.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41837.exe
      4⤵
      PID:1676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-820.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-820.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31210.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31210.exe
      4⤵
      PID:5312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20113.exe
        5⤵
        
        PID:6644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2611.exe
        6⤵
        
        PID:10800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9274.exe
        6⤵
        
        PID:15420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58073.exe
        6⤵
        
        PID:5732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14982.exe
        5⤵
        
        PID:9872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7573.exe
        5⤵
        
        PID:14824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48677.exe
        5⤵
        
        PID:15624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9310.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9310.exe
      4⤵
      PID:7352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39268.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39268.exe
      4⤵
      PID:10808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40167.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40167.exe
      4⤵
      PID:14476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52761.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52761.exe
      4⤵
      PID:10376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47360.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47360.exe
    3⤵
    PID:5452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41044.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41044.exe
      4⤵
      PID:6828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48304.exe
        5⤵
        
        PID:11700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23326.exe
        5⤵
        
        PID:16204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38770.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38770.exe
      4⤵
      PID:9996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20897.exe
      4⤵
      PID:13472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48485.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48485.exe
      4⤵
      PID:14676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4286.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4286.exe
    3⤵
    PID:7920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41658.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41658.exe
    3⤵
    PID:9652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48025.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48025.exe
    3⤵
    PID:14548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51368.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51368.exe
    3⤵
    PID:5140
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19163.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19163.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18086.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18086.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21724.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21724.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28906.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57276.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10727.exe
        7⤵
        
        PID:5772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3291.exe
        8⤵
        
        PID:15152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45986.exe
        8⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23228.exe
        7⤵
        
        PID:6992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46424.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26954.exe
        7⤵
        
        PID:6400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57551.exe
        6⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27884.exe
        7⤵
        
        PID:11352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1422.exe
        7⤵
        
        PID:1132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11281.exe
        6⤵
        
        PID:9696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44853.exe
        6⤵
        
        PID:14280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39618.exe
        6⤵
        
        PID:16144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6959.exe
        6⤵
        
        PID:8544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20882.exe
        5⤵
        
        PID:2112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32710.exe
        6⤵
        
        PID:4876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52860.exe
        7⤵
        
        PID:8212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32880.exe
        7⤵
        
        PID:13220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15812.exe
        7⤵
        
        PID:4060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23228.exe
        6⤵
        
        PID:9072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10426.exe
        6⤵
        
        PID:14248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16264.exe
        6⤵
        
        PID:4836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3227.exe
        5⤵
        
        PID:6944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63104.exe
        6⤵
        
        PID:10704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9684.exe
        6⤵
        
        PID:14348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58939.exe
        6⤵
        
        PID:3544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18516.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62290.exe
        5⤵
        
        PID:13844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25703.exe
        5⤵
        
        PID:7864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11562.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11562.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29072.exe
        5⤵
        
        PID:508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49238.exe
        6⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16234.exe
        7⤵
        
        PID:8684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41178.exe
        7⤵
        
        PID:15288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37264.exe
        7⤵
        
        PID:1668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23228.exe
        6⤵
        
        PID:8808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32033.exe
        6⤵
        
        PID:12412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16264.exe
        6⤵
        
        PID:15956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55029.exe
        5⤵
        
        PID:6900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62782.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13446.exe
        6⤵
        
        PID:12620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37795.exe
        6⤵
        
        PID:15628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23753.exe
        5⤵
        
        PID:11044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6805.exe
        5⤵
        
        PID:14856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12766.exe
        5⤵
        
        PID:7648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31109.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31109.exe
      4⤵
      PID:1456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32710.exe
        5⤵
        
        PID:6068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62782.exe
        6⤵
        
        PID:8956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13446.exe
        6⤵
        
        PID:12608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19320.exe
        6⤵
        
        PID:1844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23228.exe
        5⤵
        
        PID:9048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46424.exe
        5⤵
        
        PID:12440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35548.exe
        5⤵
        
        PID:8608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32305.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32305.exe
      4⤵
      PID:7400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30046.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30046.exe
      4⤵
      PID:11148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32032.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32032.exe
      4⤵
      PID:13532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13542.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13542.exe
      4⤵
      PID:5396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24224.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24224.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52232.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52232.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31210.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64972.exe
        6⤵
        
        PID:7004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62694.exe
        7⤵
        
        PID:11336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27873.exe
        7⤵
        
        PID:1244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8428.exe
        6⤵
        
        PID:10556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34521.exe
        6⤵
        
        PID:15000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49938.exe
        6⤵
        
        PID:16108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9502.exe
        5⤵
        
        PID:7656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45616.exe
        6⤵
        
        PID:9272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37348.exe
        6⤵
        
        PID:13448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31419.exe
        6⤵
        
        PID:5808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18079.exe
        5⤵
        
        PID:10880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37453.exe
        5⤵
        
        PID:14520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37494.exe
        5⤵
        
        PID:16432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50815.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50815.exe
      4⤵
      PID:5528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64562.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10395.exe
        6⤵
        
        PID:11116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61407.exe
        6⤵
        
        PID:14832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63414.exe
        6⤵
        
        PID:3328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62211.exe
        5⤵
        
        PID:13080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6342.exe
        5⤵
        
        PID:6532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20689.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20689.exe
      4⤵
      PID:7104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36555.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36555.exe
      4⤵
      PID:9784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44906.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44906.exe
      4⤵
      PID:15840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18912.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18912.exe
      4⤵
      PID:8124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1972.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1972.exe
    3⤵
    PID:2524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8205.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8205.exe
      4⤵
      PID:1852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36934.exe
        5⤵
        
        PID:7176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33290.exe
        5⤵
        
        PID:11780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14017.exe
        5⤵
        
        PID:15848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16466.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16466.exe
      4⤵
      PID:8524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44298.exe
        5⤵
        
        PID:16100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48147.exe
        5⤵
        
        PID:7712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19424.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19424.exe
      4⤵
      PID:4212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38147.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38147.exe
      4⤵
      PID:6180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-427.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-427.exe
    3⤵
    PID:6920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45874.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45874.exe
      4⤵
      PID:10864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22076.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22076.exe
      4⤵
      PID:14676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46948.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46948.exe
      4⤵
      PID:4384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58853.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58853.exe
    3⤵
    PID:9588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62820.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62820.exe
    3⤵
    PID:13860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46407.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46407.exe
    3⤵
    PID:6036
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25989.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25989.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60618.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60618.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39788.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39788.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38562.exe
        5⤵
        
        PID:5492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20113.exe
        6⤵
        
        PID:6832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10706.exe
        6⤵
        
        PID:11124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63620.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30637.exe
        5⤵
        
        PID:7120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46358.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65013.exe
        6⤵
        
        PID:3388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25507.exe
        5⤵
        
        PID:8248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63214.exe
        5⤵
        
        PID:14312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29917.exe
        5⤵
        
        PID:15660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45579.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45579.exe
      4⤵
      PID:4632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36062.exe
        5⤵
        
        PID:6060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29752.exe
        6⤵
        
        PID:8116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53260.exe
        7⤵
        
        PID:15028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37795.exe
        7⤵
        
        PID:1760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62211.exe
        6⤵
        
        PID:12872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46634.exe
        6⤵
        
        PID:15788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27369.exe
        6⤵
        
        PID:14416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11038.exe
        5⤵
        
        PID:7372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11831.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35289.exe
        5⤵
        
        PID:15888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10929.exe
        5⤵
        
        PID:15540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59096.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59096.exe
      4⤵
      PID:5184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13223.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39157.exe
        6⤵
        
        PID:4880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60919.exe
        5⤵
        
        PID:9948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10373.exe
        5⤵
        
        PID:14888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36963.exe
        5⤵
        
        PID:15752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48921.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48921.exe
      4⤵
      PID:7504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36173.exe
        5⤵
        
        PID:15716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23613.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23613.exe
      4⤵
      PID:12000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24862.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24862.exe
      4⤵
      PID:16168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18912.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18912.exe
      4⤵
      PID:15456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33928.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33928.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2429.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2429.exe
      4⤵
      PID:3892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8205.exe
        5⤵
        
        PID:1796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63078.exe
        6⤵
        
        PID:11940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65013.exe
        6⤵
        
        PID:3460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23228.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49321.exe
        5⤵
        
        PID:14052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40702.exe
        5⤵
        
        PID:448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55029.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55029.exe
      4⤵
      PID:6952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59274.exe
        5⤵
        
        PID:7936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19476.exe
        5⤵
        
        PID:12712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49434.exe
        5⤵
        
        PID:15956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46302.exe
        5⤵
        
        PID:1576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12651.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12651.exe
      4⤵
      PID:9572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5418.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5418.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10618.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10618.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2329.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2329.exe
    3⤵
    PID:2256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16758.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16758.exe
      4⤵
      PID:6224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3789.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42548.exe
        5⤵
        
        PID:13348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55734.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42086.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42086.exe
      4⤵
      PID:8804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36694.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36694.exe
      4⤵
      PID:13392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31230.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31230.exe
      4⤵
      PID:764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11998.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11998.exe
    3⤵
    PID:6888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45616.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45616.exe
      4⤵
      PID:9284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37348.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37348.exe
      4⤵
      PID:13432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50431.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50431.exe
      4⤵
      PID:5836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6727.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6727.exe
    3⤵
    PID:10096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46678.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46678.exe
    3⤵
    PID:13892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40401.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40401.exe
    3⤵
    PID:5400
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35159.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35159.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62538.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62538.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9227.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9227.exe
      4⤵
      PID:5544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24926.exe
        5⤵
        
        PID:6260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57868.exe
        6⤵
        
        PID:8268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42881.exe
        6⤵
        
        PID:14404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14743.exe
        6⤵
        
        PID:608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42086.exe
        5⤵
        
        PID:8876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15086.exe
        5⤵
        
        PID:13748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35807.exe
        5⤵
        
        PID:14020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55989.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55989.exe
      4⤵
      PID:3048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33914.exe
        5⤵
        
        PID:11540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10467.exe
        5⤵
        
        PID:5580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9527.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9527.exe
      4⤵
      PID:10084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6342.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6342.exe
      4⤵
      PID:14028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26954.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26954.exe
      4⤵
      PID:7452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35594.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35594.exe
    3⤵
    PID:5800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55896.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55896.exe
      4⤵
      PID:11456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48485.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48485.exe
      4⤵
      PID:7688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36964.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36964.exe
    3⤵
    PID:8836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5698.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5698.exe
      4⤵
      PID:7644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37899.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37899.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:12452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11505.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11505.exe
    3⤵
    PID:5684
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45240.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45240.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31210.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31210.exe
    3⤵
    PID:5288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-997.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-997.exe
      4⤵
      PID:6284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10805.exe
        5⤵
        
        PID:9224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30934.exe
        5⤵
        
        PID:13908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10807.exe
        5⤵
        
        PID:6596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42086.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42086.exe
      4⤵
      PID:8700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15086.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15086.exe
      4⤵
      PID:13744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65527.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65527.exe
    3⤵
    PID:6688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52860.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52860.exe
      4⤵
      PID:8520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32880.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32880.exe
      4⤵
      PID:13228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14206.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14206.exe
      4⤵
      PID:5688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55822.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55822.exe
    3⤵
    PID:8448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58319.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58319.exe
    3⤵
    PID:12972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36191.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36191.exe
    3⤵
    PID:1672
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50412.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50412.exe
  2⤵
  PID:5976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57380.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57380.exe
    3⤵
    PID:6936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60556.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60556.exe
      4⤵
      PID:11556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10467.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10467.exe
      4⤵
      PID:5604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5906.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5906.exe
    3⤵
    PID:8312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-477.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-477.exe
    3⤵
    PID:13888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22566.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22566.exe
    3⤵
    PID:7620
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36577.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36577.exe
  2⤵
  PID:8016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7721.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7721.exe
    3⤵
    PID:13204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17443.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17443.exe
    3⤵
    PID:15456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10467.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10467.exe
    3⤵
    PID:8900
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45518.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45518.exe
  2⤵
  PID:9496
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46890.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46890.exe
  2⤵
  PID:14944
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28398.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28398.exe
  2⤵
  PID:2520

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10794.exe

Filesize
468KB

MD5
b27f5728f1a88a87bf6ec1097527002e

SHA1
a996e32a0ee9064eed38053de542dd98cdadccac

SHA256
07d6d6c172d8470f55a0be08a76acb88d90b7dee15dfc69925eede3e9904d0ab

SHA512
54fcfa5395fd8bacceca678d582281ccea46dd4994d4aab61b1191f297a781b51fb96525ae20292210ba9e88d3b30900a7094da5e3231f0792255afc09d8950f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11317.exe

Filesize
468KB

MD5
1b5e7c30f434badf1ac2c780a6b2d316

SHA1
46a1b7e9b26c58723fb4de38542e76f28f320228

SHA256
e870010ca1626cf5760dd626dd7e4500eec840f5efddc2f9e3f550499429eedc

SHA512
b141912bf787f384408ecd5f532a5e7c3fcc9fb14b94b9ca170d43243ddf4e4b83494cfad55ac970a791c5570689368f70f5453ccfdbb9d82848a4771874010f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12055.exe

Filesize
468KB

MD5
3d7d89fbf3779f556d3db1bbb57d2d2c

SHA1
2d87f4558a0e7c5ba438699275a759666abada0c

SHA256
5e2f76974a1295da03d19d802b58bb7ba856fb39fdf42f61170191049aaf6841

SHA512
5a64c2251b0b49f02a2658d6132cd08d6863db6af9026c1bb7d1c1a544b1ab3e888ec68a66c55eb8f3234d762bd55c09ec64b9d09d6eed393a19a7179e7056a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1344.exe

Filesize
468KB

MD5
27dd499a2659d8ec25677eb2cf851db7

SHA1
4c2dcce11348b087ded33d2b84b577d37b3122c4

SHA256
86a6c1dd993e3f023827a3113d939f14224eb2f72664973bcbbbd2624a89a777

SHA512
7176911a33cf8f93e5152fe0e694792ef3e99c9359fb64b32742d192ecf30e04b4c856e7c10ba58c045f168eff45f7376f6d008516073484f3d2a705a5b6f184

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14006.exe

Filesize
468KB

MD5
cca5e298eab5ded3802b1d6eddf7b65c

SHA1
9312a90b6511d45e29b4b481ba8a328325e7c18b

SHA256
758c665c625f6e8cc5aa25c9ce390eba50859f4d75423365c75ca0ff3a76dfde

SHA512
7bf00edcf92c73278a73f278059bb36bda051ba7b94a4e6cc0cf8ab1c4d53156b0d8e819c0039bcf0616c15ef78fa8f121162f637c145cd99b7d8195901983ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17809.exe

Filesize
468KB

MD5
614c0683ac8934cc6e23d105d9cfccc1

SHA1
917abaf480a3bbbfd9c462c0c736968e796bcbe1

SHA256
c40a7527f2ec1f073c6fa4e00de6f813a6d0c89d6f8e188fa2cd34f2c119a17d

SHA512
3d7f4796b1e73ac92060768386b68eb83a31213d6a59869690cf71736b0ff9a890c6746b1fb62753db28a20553d534dfb5b23c8801f21e20d2ae683f9329be1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18086.exe

Filesize
468KB

MD5
162cbbb26a3d17eee158b83e2df06d2f

SHA1
0a5e0e25113d1558b5236fad8c2dd207e23eabb6

SHA256
ab7075a650f625f89457e9f9457b8a3371a8a2b59bba4e8bf9c46031ec636707

SHA512
072565aab107e6ac850c086dd45213c1cd3841972ce9b407f6e4e5cb0bcb0b8d4cda2f140f28c1dbf1902a69fc20fa32a1f8ae75e8126485d568906852cf1568

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19163.exe

Filesize
468KB

MD5
3b346135fb35b794bb20ad3ad66c25eb

SHA1
baa808a036cb49332802bbf08d3c66cfd310bb71

SHA256
2883f9d0bf987167c8ef4c8cb386df6de48cc1b088309fa9d04e602e6788ad30

SHA512
ec781b5ca5e99efdcd9c6869b361d4c67920a276b67babbb3875c406fc1c74bd78fbc45506a9f51022fcf49c2d0a666ebfe8043ad00ea1ef5a2dd27d270962c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21210.exe

Filesize
468KB

MD5
f20192e8f0e208c8f79f4eba92844a48

SHA1
65cd66e77216a9054ac824dbbbf4c215f8142051

SHA256
9451b23044813504d2792a14e73084cc4b1ff42eec33baf84b081184a072ec36

SHA512
7771e747643aaadafd4611ac80d7f68db3cd24436f3cceb58abd8430aeb579970e6a0e377c5ffb0742220b277feb2d4d818ef6cdadeba4bec6ab7a733ae2ac6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21724.exe

Filesize
468KB

MD5
8ede3b26c95ec4e8429a2323b95a50ed

SHA1
1fe23bb099d1f0dd02c83ee967214739d573c6d4

SHA256
4cd9c9cb6cdd843d1def4658fece852a032f074ed8f22d7370e14e688190d8cc

SHA512
b5f7248b78bebe1ce3ff2c548b5ec82ac827819872995718471f232097455a4e1a3c3488d6fcc17e34a3305c33b312f9de52e1311f3cf900ad9cd0522e6ead77

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2304.exe

Filesize
468KB

MD5
f42a083d9494ef9df87f4fe464890ba7

SHA1
b3aba1f765f9840ffbaa32072ca87a1728743219

SHA256
6ccfc9b5c39d95d21512e141e8d7022a7f2da75092512a573631c1b9a5424980

SHA512
a4235e14be3eb3e8cd68c091b2b032eb876cac5a6bdc23b131d7242470eb3eddf7db6c2839224b77b5df05ce0ade39b27ea800e8dbeb67f8e5bb26dfdf786024

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24224.exe

Filesize
468KB

MD5
2b4fd11001d5827e36e9e7ca037ede30

SHA1
b1e92f970a59b5a27dea262b6492b4d2f96ef6fe

SHA256
1bdaca5fc9c9cfba13893ae97215a3231a95dae40f27779eac464c3de269a20d

SHA512
fc4e17a17d843a77aeefb79e4af983c77c55bb265c2b4aeec1afe5d02c55e99bb2326a6eb6931cff23b36326ff40e421fa2d342ca8ff951b96d4adf1cc8e0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25989.exe

Filesize
468KB

MD5
e08fa2fc67562410f0819c372fd490f5

SHA1
30d2aaa8793455e5c72766229fd0faa80370a8fc

SHA256
cab6f948f1c3262a83ab3fdc9c11fe53ca3a5f4aa0bad6e58303bbdf2c7409f8

SHA512
2eda6cba54ca73adedb677e3023953e2203d4f5a09c6b517163867babcf54e0869b03bd403fea6956b542bb04dcd031fb0d7257bb3cad0e95722974e92196d9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27681.exe

Filesize
468KB

MD5
b314c7f0bfe97d88d28359ce43e151cb

SHA1
dc97994aba42c2e144aaac373200eba7246c20b6

SHA256
5c17faa55c3bbcd7612e6cbb02cc6a435797eb9fd64bfe0ddef25e0ddf206703

SHA512
be86b63869c776ed135b8d69d76465fdfc1f7b99c33025bf1a36458c2d40ed7ebbb2a4481dc7d4d295bec86301b2b03cbb0a783deca165d602a1ce8ed4fd3fae

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32392.exe

Filesize
468KB

MD5
e66797b24e286320004298d6faee4d44

SHA1
1b5537220c5d8af6860cfb0af9827f5e2b0e4bbc

SHA256
f80cf7bd66cbeaae89f236e550ece4a238fcf19eaf6316a43241649699242c40

SHA512
ecd94bfa594dbf6cedba27b4c1e740b13eced55a4331f663279dbdbf085748dc9b0e9a5f65be1cdd6913761a6630b4a62c77ad883cc15d2bea4491e895957ac0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35159.exe

Filesize
468KB

MD5
b2beb25ab086796cde85d16375ebb22d

SHA1
d16d7a12826da5df698f916abbeb690f1d0b0cb6

SHA256
446bc24c2fb7154f9307274ff34d81b35ba01cd7c0dc1303e4783c54ef0519cf

SHA512
8564181309a988e298bd5ebc8d16963bd897a9bf7fcf06cf86addde77a5f8208162f61d8240645eb7595d696279e2036f3d36afa9b6c58abcd5befe77420b419

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35730.exe

Filesize
468KB

MD5
d8c7917f8d123c404e2b4ef0e898e984

SHA1
56ea83fcfc468d04e613c9e0de59de1a52eac42d

SHA256
9d9ef49c644a74169cdf2cb4abcf6ba67b28676920452f47e9013c28e29f59ad

SHA512
f824f32ba463cd8ebd713ef32f5f0993e45fb9bad8aed7ef120203de0b9b068710ef282dfa75fa0dc2014c9ef4fdbfa8995c9210aebb23044b6c3404d4af7fa9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36652.exe

Filesize
468KB

MD5
f05c7148bb0b90c803b69a18fbcf3dc3

SHA1
a7468a87c4b854c38b2ba01dd526c69792a6d070

SHA256
3a0af3c7718d906e3b9c085b46c65929604cf1266bee7bc35f97b7ebd60280ee

SHA512
2f68b7cf2e6288a63175a3aa01c43abaac31b11afb0f3046a361231241ca55dadb815b7b2b93438581592bbde07a07688fee192d54e275be642415226b2eae43

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43026.exe

Filesize
468KB

MD5
a0d241cc9c76f5b189bb202ae79d5380

SHA1
4ace7193b264a2de15a57a458976f20361a53c95

SHA256
158cf4a63ffe5a0b1f16e309e49dc16701d6b9932e7a24ac4879c119cda8588f

SHA512
68a801033256f6f5d80b45e5b053a010a50153905d959ce90cc5b4daf1d316584cd8f4ab2d8548ab6125df7a4a5e2c506aaeb2a39424ed8b39ef9c4a238e2360

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44090.exe

Filesize
468KB

MD5
19e7206d1cbf51aaa88c9f4771f57fd2

SHA1
db038899e356fe6ea3cdaf70f5d33ae7052da14e

SHA256
5a1de5ae8ec37e702cde37dac6eddbd742edebca4d777698d0c3f0695ad8cc55

SHA512
6078c67a94a8d7447462dd38c05a7da32e3656111800172bdd8ea2a952c20639a2dbc98d985f42d7daf3b6de04e705cfe45d1f6d362856254d80c2c6a7f45580

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45138.exe

Filesize
468KB

MD5
ad45c79c7e703956fa839a2fbec1471b

SHA1
ee6cac8ea636c7a5b5be669774c3926b5894df6d

SHA256
6b12757b34ec0e3b0835ef340ce4ee953583d7700c8039a6a84173bae01ce99a

SHA512
1401b421e9ab42026a1de8f61a910b8f2e85ffee012a69eb1dfcd79fbac5d71880e32eeb316f9b1597c56abb405d896e38ab300f410c1b9b53b06c08967899c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45444.exe

Filesize
468KB

MD5
0893c5b1198bce2428d39197dab6590f

SHA1
961a41bc7b4342ff3170e76775a9a9685dfdf1cf

SHA256
c682e3c8dfba75eb7ae8268bed41793566714a14524c3d14257eea0c25a1f0d9

SHA512
a8e23bfdba6b3c47e0acb773022a5a9c0ffb502a040e720eef37390f3a256af3cded661733f305ff11b02054f629a0b9aec4916df2a2b5f13b27cb9b830d2f0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46128.exe

Filesize
468KB

MD5
0fe678cc3dcb6af127a87339e78ae4f1

SHA1
f84eec119fac4080b2536900c65457ab1be7d5de

SHA256
bf2f9d6d3aefdf242db19e09a09723463ea239bbd5a0f7443eca166a52207d4f

SHA512
d5c0ac9b208a08389e9fb7138fa7d9eb6744ad8d1d1ccf77f8635d7f1259040c0bcc36c3f8a78888137a30254ce007ecd6e2b3dcb2917bd9f5d35eca569910be

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48174.exe

Filesize
468KB

MD5
1710b8221dacee71588939c335e57159

SHA1
f682330449528aaa9431542172bc2ee0c59499f9

SHA256
d7e9f18fd1a7cf92603687584c90e08f1952b5570beaac51cd27fd7b6cfb5294

SHA512
7b348a06d871823a16be0278ba3a25b34ea007dc6524beedeba4491257a332a71c7b0505f075eb80ed45934117e93ebd315e67fc20458ee4cc8f81f4ae37f226

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52450.exe

Filesize
468KB

MD5
b8b34c2aac61c6cedd2d309fa53a3910

SHA1
e49a0792e3c1aeeac0aee59162fad1dc78808b66

SHA256
38ddaf2beb79c376f030075628de5b46daf381d2005be2ac274808c2fac46233

SHA512
2b43604dc234434da97b650a811e854d8f0fa75d239f4387e3569c116c3061ce81406fe8d24ce18ef8739154764791b28a2f1346ec3b4901a4d773e664add0aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56705.exe

Filesize
468KB

MD5
fd50eef57694f39af99d25b7def55c90

SHA1
4e4ca27f71454ce9a740cc97f8836620efae7c64

SHA256
ee3a80fc564073a74f6fe12e81f57ef9dd1970620bef7cfbc080ef66d0f511e6

SHA512
4e3a881b07bc7b80f680ae374710a3490bb0af69c686bd9032705a6c9899cff489d64a08c4936c058d6d9afd3a2fc89cf60cb45a7a495f88df59bf45e43a071c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59035.exe

Filesize
468KB

MD5
a83ee9d5e63ffe700e6b9aac91e6613e

SHA1
f91cb6c8f7acdf7ffc3331eb3b165441788a0d8b

SHA256
1229574d7517e8b5f06622c62dffbee9710a01dd06cca9be2bc3c32f1b55dad2

SHA512
3042d3175da794e4239c3f76a47bbda9d906878a8c454c96df5875f3c51213d4b893e71935728fa41b7aec934de3da5be1c83f9215ef0a417b187f06dc9e2366

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5963.exe

Filesize
468KB

MD5
daaceb69fcf311324d1f44f5a301c42e

SHA1
51d15b1abe270b7c8c7b49dbdb398be780365992

SHA256
a7b67dd17d3303058ed62b0a458806c14ed89f9593aba2acbd5b5dff654ad989

SHA512
3b461707ca525241361d8ebdca727c7621a273aba5eb43529751457f88a49a39d0c079177cea4b0400d4ef90784a4f6f008697d990d35fdd667a8d092037abe3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60618.exe

Filesize
468KB

MD5
32e3c5444548b315adb9fb51ba426389

SHA1
ee41601d6f149dda885e3c23a331783879f4653f

SHA256
2de0a0bb2afad6a89069399c90fb3c53562bec43bfb61da2914809775267e0df

SHA512
d0c30c933d6fc427fef074af01e2de33962b2b34ea64d08df84fe90aa21d5a1de520d5ed22cc3d30f91f8168ffffa2f3b8d74d5ce01be0ebdfd1f5b09dd31479

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61386.exe

Filesize
468KB

MD5
b5eaf79602803df0e9d299bca801a4e8

SHA1
f9ab78ba5d87e41bab7b5a82208fc09c76d38008

SHA256
633856faeac8385d779527a8dbbfabf0c8220dbd7ccf6a95af9f419a58a018da

SHA512
5908363d5cda7e966871d39ae58807ecf06f3d926561c6764412d4611daefef67775f21371bf1710d16d6edb5025c34bc1bf36ffd69d716c762ebac65854627c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63202.exe

Filesize
468KB

MD5
742a502b3f47c80cc4ce7fdcc008ae39

SHA1
5c9da19b5ab00a48794e192fdbf21071cd0a9453

SHA256
c2716862ef87e5a1095042fb72399d4df23f26ef0b806cb4f2027e230c22643c

SHA512
8f667244f44b792cc242c9b665e8b9060c99da944f99a6cb1c09ef602931386b8e8f7cb82a7215a409d888d8b5c017f38e56d936056ee901c14817ff923f460f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6388.exe

Filesize
468KB

MD5
f75d402683c8cca96e139a6a9419fe0c

SHA1
27dd56b9c95322ac78e804f9382544a22f0af695

SHA256
5917abdf9f5f87e974795d824d23e4bc730138e87fd369d00cacbed80457568c

SHA512
aa66d4f2f3e9742a53fc4c50a81850ac71aee2df4f6316f56ad6f2eab2f372e4cd27b2ae73fdc81196d56d5a15d8c958030d94017dddb88b4d819bff7dbe9f15

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64598.exe

Filesize
468KB

MD5
e9d8b8d650006707db1a6dde5570ec42

SHA1
86377d0a0afc4a5a405fe1e8d6d41a93a48a956d

SHA256
c21643e9a22654d4f0d4620df07aae1565767be5dee3957b559dff103e79f2f1

SHA512
b38b2bfd8be77a7a223545ff33fcf8a57e66c32df188dc244948cd1d56858adf1b5c16af1a8a8c50f2f45c54db361ad1110a23ae01af0d023d5b4d9b84851e88

Download Submit
memory/220-470-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/440-3435-0x00000000763A0000-0x0000000076483000-memory.dmp

Filesize
908KB

Download
memory/460-136-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/508-441-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/652-210-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/768-252-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1148-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1236-82-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1260-405-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1372-481-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1400-283-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1456-445-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1480-247-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1516-260-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1564-357-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1588-66-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1640-213-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1708-267-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1724-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1740-71-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1780-284-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1872-221-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1892-361-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1924-391-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1976-444-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2012-452-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2028-28-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2112-412-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2136-182-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2212-3544-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2256-450-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2308-468-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2376-360-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2484-400-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2524-469-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2560-331-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2564-259-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2580-114-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2584-335-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2616-86-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2860-297-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2916-411-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3064-99-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3068-479-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3116-404-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3124-240-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3132-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3240-235-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3248-327-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3352-359-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3452-193-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3504-296-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3556-194-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3564-328-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3872-44-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3892-443-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3948-39-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3960-120-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4000-362-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4036-40-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4040-333-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4072-273-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4168-192-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4196-224-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4240-403-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4244-363-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4280-442-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4316-358-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4328-161-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4332-180-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4356-281-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4360-81-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4396-451-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4420-334-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4520-185-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4536-19-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4616-398-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4632-399-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4640-179-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4896-332-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4904-55-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4920-478-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4976-318-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4988-107-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5052-3566-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5064-181-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5088-2540-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5088-125-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5208-529-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5232-528-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5240-506-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5252-505-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5260-537-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5288-507-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5356-540-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5452-541-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5460-542-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5476-543-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5492-564-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5536-565-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15824-2762-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/16024-3121-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/16156-2633-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads