816a052d6c2f5fef7905e19e98c998db4877167aa653ab9cb651b3731ac1fc2e

Analysis

max time kernel
120s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 06:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

816a052d6c2f5fef7905e19e98c998db4877167aa653ab9cb651b3731ac1fc2eN.exe
Size

468KB
MD5

8e3661d3a04fee40a53ddce5f14e76c0
SHA1

7c79ab4d279b8a898c737d15adc36af9aec4ed5a
SHA256

816a052d6c2f5fef7905e19e98c998db4877167aa653ab9cb651b3731ac1fc2e
SHA512

600f5b394de446030e7a0b6209eba74894c4eeac770118ad6ae01e70400bdaa3d352e023620b8469eafcf7e22e4f6bff9c07f6ac9ac6d93a38105a3c4bf1bf26
SSDEEP

3072:Mq0RogFdjY8U2bxoPzsWff5kC9TWXpXkmHevVpfnt8oQ3Xpa4s5lC:Mqyoq1U2yPQWffE5unt8ouZa4s

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1544	Unicorn-23236.exe
3652	Unicorn-55244.exe
2600	Unicorn-2706.exe
2808	Unicorn-24034.exe
3984	Unicorn-43900.exe
2648	Unicorn-11227.exe
2136	Unicorn-5097.exe
3084	Unicorn-5851.exe
2500	Unicorn-42202.exe
2548	Unicorn-53708.exe
4508	Unicorn-47578.exe
4080	Unicorn-17506.exe
1896	Unicorn-53708.exe
2040	Unicorn-53708.exe
4604	Unicorn-37107.exe
3028	Unicorn-15660.exe
4084	Unicorn-29042.exe
2784	Unicorn-23252.exe
2556	Unicorn-49602.exe
376	Unicorn-56308.exe
2404	Unicorn-14705.exe
5088	Unicorn-7299.exe
936	Unicorn-56116.exe
3820	Unicorn-56116.exe
2392	Unicorn-15275.exe
3180	Unicorn-3578.exe
4212	Unicorn-15275.exe
3572	Unicorn-6842.exe
3956	Unicorn-26074.exe
1656	Unicorn-39810.exe
2388	Unicorn-52779.exe
4308	Unicorn-195.exe
4696	Unicorn-31908.exe
4176	Unicorn-12042.exe
1780	Unicorn-9441.exe
4892	Unicorn-39604.exe
4036	Unicorn-56443.exe
4332	Unicorn-30860.exe
3380	Unicorn-27522.exe
2708	Unicorn-47196.exe
5020	Unicorn-6739.exe
696	Unicorn-6739.exe
1584	Unicorn-5977.exe
2520	Unicorn-31052.exe
4052	Unicorn-22884.exe
976	Unicorn-22114.exe
3912	Unicorn-62499.exe
3120	Unicorn-491.exe
2212	Unicorn-32972.exe
3480	Unicorn-33164.exe
4520	Unicorn-16562.exe
2692	Unicorn-13106.exe
3236	Unicorn-16636.exe
748	Unicorn-54139.exe
3616	Unicorn-43370.exe
1972	Unicorn-37802.exe
1168	Unicorn-37802.exe
2780	Unicorn-32972.exe
1948	Unicorn-32972.exe
4424	Unicorn-51538.exe
3228	Unicorn-62307.exe
3324	Unicorn-51538.exe
432	Unicorn-26340.exe
4828	Unicorn-10003.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
15788	14764	WerFault.exe	712

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54562.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24682.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22873.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38516.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39984.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24517.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43853.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49718.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33113.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52404.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49820.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39476.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53708.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6739.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49747.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11363.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25065.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61084.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31616.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45819.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59762.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24517.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39984.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49718.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60764.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36620.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27799.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63980.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41053.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41583.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12042.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13706.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35330.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10058.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54163.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30812.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28364.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65098.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60339.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18983.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30117.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48682.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23236.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40314.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32351.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42042.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50058.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36816.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23921.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26882.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55626.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6913.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24517.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39984.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35127.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37876.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26882.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48649.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43900.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62419.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7147.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46748.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26882.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55316.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	4572	dwm.exe
Token: SeChangeNotifyPrivilege	4572	dwm.exe
Token: 33	4572	dwm.exe
Token: SeIncBasePriorityPrivilege	4572	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1636	816a052d6c2f5fef7905e19e98c998db4877167aa653ab9cb651b3731ac1fc2eN.exe
1544	Unicorn-23236.exe
3652	Unicorn-55244.exe
2600	Unicorn-2706.exe
2808	Unicorn-24034.exe
3984	Unicorn-43900.exe
2648	Unicorn-11227.exe
2136	Unicorn-5097.exe
3084	Unicorn-5851.exe
2500	Unicorn-42202.exe
2040	Unicorn-53708.exe
4080	Unicorn-17506.exe
2548	Unicorn-53708.exe
4508	Unicorn-47578.exe
4604	Unicorn-37107.exe
1896	Unicorn-53708.exe
3028	Unicorn-15660.exe
4084	Unicorn-29042.exe
2556	Unicorn-49602.exe
2784	Unicorn-23252.exe
376	Unicorn-56308.exe
2404	Unicorn-14705.exe
936	Unicorn-56116.exe
3820	Unicorn-56116.exe
5088	Unicorn-7299.exe
2392	Unicorn-15275.exe
4212	Unicorn-15275.exe
1656	Unicorn-39810.exe
3956	Unicorn-26074.exe
2388	Unicorn-52779.exe
3180	Unicorn-3578.exe
3572	Unicorn-6842.exe
4696	Unicorn-31908.exe
4308	Unicorn-195.exe
4176	Unicorn-12042.exe
1780	Unicorn-9441.exe
4892	Unicorn-39604.exe
4036	Unicorn-56443.exe
4332	Unicorn-30860.exe
3380	Unicorn-27522.exe
2708	Unicorn-47196.exe
5020	Unicorn-6739.exe
1584	Unicorn-5977.exe
2520	Unicorn-31052.exe
696	Unicorn-6739.exe
4052	Unicorn-22884.exe
3912	Unicorn-62499.exe
3480	Unicorn-33164.exe
4520	Unicorn-16562.exe
976	Unicorn-22114.exe
2692	Unicorn-13106.exe
3120	Unicorn-491.exe
2212	Unicorn-32972.exe
3324	Unicorn-51538.exe
748	Unicorn-54139.exe
2780	Unicorn-32972.exe
3236	Unicorn-16636.exe
3228	Unicorn-62307.exe
1168	Unicorn-37802.exe
3616	Unicorn-43370.exe
1948	Unicorn-32972.exe
1972	Unicorn-37802.exe
4424	Unicorn-51538.exe
2144	Unicorn-37122.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 1544	1636	816a052d6c2f5fef7905e19e98c998db4877167aa653ab9cb651b3731ac1fc2eN.exe	86
PID 1636 wrote to memory of 1544	1636	816a052d6c2f5fef7905e19e98c998db4877167aa653ab9cb651b3731ac1fc2eN.exe	86
PID 1636 wrote to memory of 1544	1636	816a052d6c2f5fef7905e19e98c998db4877167aa653ab9cb651b3731ac1fc2eN.exe	86
PID 1544 wrote to memory of 3652	1544	Unicorn-23236.exe	88
PID 1544 wrote to memory of 3652	1544	Unicorn-23236.exe	88
PID 1544 wrote to memory of 3652	1544	Unicorn-23236.exe	88
PID 1636 wrote to memory of 2600	1636	816a052d6c2f5fef7905e19e98c998db4877167aa653ab9cb651b3731ac1fc2eN.exe	89
PID 1636 wrote to memory of 2600	1636	816a052d6c2f5fef7905e19e98c998db4877167aa653ab9cb651b3731ac1fc2eN.exe	89
PID 1636 wrote to memory of 2600	1636	816a052d6c2f5fef7905e19e98c998db4877167aa653ab9cb651b3731ac1fc2eN.exe	89
PID 1544 wrote to memory of 2808	1544	Unicorn-23236.exe	92
PID 1544 wrote to memory of 2808	1544	Unicorn-23236.exe	92
PID 1544 wrote to memory of 2808	1544	Unicorn-23236.exe	92
PID 3652 wrote to memory of 3984	3652	Unicorn-55244.exe	93
PID 3652 wrote to memory of 3984	3652	Unicorn-55244.exe	93
PID 3652 wrote to memory of 3984	3652	Unicorn-55244.exe	93
PID 2600 wrote to memory of 2648	2600	Unicorn-2706.exe	94
PID 2600 wrote to memory of 2648	2600	Unicorn-2706.exe	94
PID 2600 wrote to memory of 2648	2600	Unicorn-2706.exe	94
PID 1636 wrote to memory of 2136	1636	816a052d6c2f5fef7905e19e98c998db4877167aa653ab9cb651b3731ac1fc2eN.exe	95
PID 1636 wrote to memory of 2136	1636	816a052d6c2f5fef7905e19e98c998db4877167aa653ab9cb651b3731ac1fc2eN.exe	95
PID 1636 wrote to memory of 2136	1636	816a052d6c2f5fef7905e19e98c998db4877167aa653ab9cb651b3731ac1fc2eN.exe	95
PID 3984 wrote to memory of 3084	3984	Unicorn-43900.exe	96
PID 3984 wrote to memory of 3084	3984	Unicorn-43900.exe	96
PID 3984 wrote to memory of 3084	3984	Unicorn-43900.exe	96
PID 3652 wrote to memory of 2500	3652	Unicorn-55244.exe	97
PID 3652 wrote to memory of 2500	3652	Unicorn-55244.exe	97
PID 3652 wrote to memory of 2500	3652	Unicorn-55244.exe	97
PID 2136 wrote to memory of 2548	2136	Unicorn-5097.exe	99
PID 2136 wrote to memory of 2548	2136	Unicorn-5097.exe	99
PID 2136 wrote to memory of 2548	2136	Unicorn-5097.exe	99
PID 1544 wrote to memory of 4508	1544	Unicorn-23236.exe	98
PID 1544 wrote to memory of 4508	1544	Unicorn-23236.exe	98
PID 1544 wrote to memory of 4508	1544	Unicorn-23236.exe	98
PID 2600 wrote to memory of 4080	2600	Unicorn-2706.exe	102
PID 2600 wrote to memory of 4080	2600	Unicorn-2706.exe	102
PID 2600 wrote to memory of 4080	2600	Unicorn-2706.exe	102
PID 2808 wrote to memory of 1896	2808	Unicorn-24034.exe	103
PID 2808 wrote to memory of 1896	2808	Unicorn-24034.exe	103
PID 2808 wrote to memory of 1896	2808	Unicorn-24034.exe	103
PID 2648 wrote to memory of 2040	2648	Unicorn-11227.exe	100
PID 2648 wrote to memory of 2040	2648	Unicorn-11227.exe	100
PID 2648 wrote to memory of 2040	2648	Unicorn-11227.exe	100
PID 1636 wrote to memory of 4604	1636	816a052d6c2f5fef7905e19e98c998db4877167aa653ab9cb651b3731ac1fc2eN.exe	101
PID 1636 wrote to memory of 4604	1636	816a052d6c2f5fef7905e19e98c998db4877167aa653ab9cb651b3731ac1fc2eN.exe	101
PID 1636 wrote to memory of 4604	1636	816a052d6c2f5fef7905e19e98c998db4877167aa653ab9cb651b3731ac1fc2eN.exe	101
PID 3084 wrote to memory of 3028	3084	Unicorn-5851.exe	104
PID 3084 wrote to memory of 3028	3084	Unicorn-5851.exe	104
PID 3084 wrote to memory of 3028	3084	Unicorn-5851.exe	104
PID 3984 wrote to memory of 4084	3984	Unicorn-43900.exe	105
PID 3984 wrote to memory of 4084	3984	Unicorn-43900.exe	105
PID 3984 wrote to memory of 4084	3984	Unicorn-43900.exe	105
PID 2500 wrote to memory of 2784	2500	Unicorn-42202.exe	106
PID 2500 wrote to memory of 2784	2500	Unicorn-42202.exe	106
PID 2500 wrote to memory of 2784	2500	Unicorn-42202.exe	106
PID 3652 wrote to memory of 2556	3652	Unicorn-55244.exe	107
PID 3652 wrote to memory of 2556	3652	Unicorn-55244.exe	107
PID 3652 wrote to memory of 2556	3652	Unicorn-55244.exe	107
PID 4604 wrote to memory of 376	4604	Unicorn-37107.exe	108
PID 4604 wrote to memory of 376	4604	Unicorn-37107.exe	108
PID 4604 wrote to memory of 376	4604	Unicorn-37107.exe	108
PID 1636 wrote to memory of 2404	1636	816a052d6c2f5fef7905e19e98c998db4877167aa653ab9cb651b3731ac1fc2eN.exe	109
PID 1636 wrote to memory of 2404	1636	816a052d6c2f5fef7905e19e98c998db4877167aa653ab9cb651b3731ac1fc2eN.exe	109
PID 1636 wrote to memory of 2404	1636	816a052d6c2f5fef7905e19e98c998db4877167aa653ab9cb651b3731ac1fc2eN.exe	109
PID 2040 wrote to memory of 5088	2040	Unicorn-53708.exe	110

C:\Users\Admin\AppData\Local\Temp\816a052d6c2f5fef7905e19e98c998db4877167aa653ab9cb651b3731ac1fc2eN.exe
"C:\Users\Admin\AppData\Local\Temp\816a052d6c2f5fef7905e19e98c998db4877167aa653ab9cb651b3731ac1fc2eN.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23236.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23236.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55244.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55244.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43900.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43900.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5851.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15660.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-195.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10003.exe
        8⤵
        Executes dropped EXE
        
        PID:4828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30476.exe
        9⤵
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65284.exe
        10⤵
        
        PID:7356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3162.exe
        10⤵
        
        PID:10900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17393.exe
        10⤵
        
        PID:15012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49718.exe
        10⤵
        
        PID:16380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29570.exe
        9⤵
        
        PID:7768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28617.exe
        9⤵
        
        PID:14124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39592.exe
        9⤵
        
        PID:4748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39546.exe
        8⤵
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33100.exe
        9⤵
        
        PID:7420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24874.exe
        9⤵
        
        PID:12108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27178.exe
        9⤵
        
        PID:16496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21681.exe
        8⤵
        
        PID:7448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49684.exe
        9⤵
        
        PID:1800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3112.exe
        9⤵
        
        PID:6828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-90.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-90.exe
        8⤵
        
        PID:12452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48682.exe
        8⤵
        
        PID:8540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29441.exe
        7⤵
        
        PID:4256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46340.exe
        8⤵
        
        PID:6960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62419.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-427.exe
        9⤵
        
        PID:8000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14779.exe
        10⤵
        
        PID:14536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27799.exe
        10⤵
        
        PID:17248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55626.exe
        9⤵
        
        PID:6384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24517.exe
        9⤵
        
        PID:15312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56466.exe
        8⤵
        
        PID:9112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34683.exe
        8⤵
        
        PID:13052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35127.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29939.exe
        7⤵
        
        PID:6612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28492.exe
        8⤵
        
        PID:9808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25082.exe
        8⤵
        
        PID:14308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27516.exe
        8⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14465.exe
        7⤵
        
        PID:9684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46290.exe
        7⤵
        
        PID:13416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40514.exe
        7⤵
        
        PID:4884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12042.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26340.exe
        7⤵
        Executes dropped EXE
        
        PID:432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10714.exe
        8⤵
        
        PID:6832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49820.exe
        9⤵
        
        PID:7820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24874.exe
        9⤵
        
        PID:12100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41053.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64634.exe
        8⤵
        
        PID:9100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37216.exe
        9⤵
        
        PID:15904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61482.exe
        8⤵
        
        PID:13836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24517.exe
        8⤵
        
        PID:16292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47907.exe
        7⤵
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12139.exe
        8⤵
        
        PID:8108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63987.exe
        8⤵
        
        PID:7264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24517.exe
        8⤵
        
        PID:14592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62714.exe
        7⤵
        
        PID:8004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49291.exe
        7⤵
        
        PID:12468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26321.exe
        7⤵
        
        PID:14840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57338.exe
        7⤵
        
        PID:15844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37122.exe
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37108.exe
        7⤵
        
        PID:5144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49036.exe
        8⤵
        
        PID:6448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5227.exe
        9⤵
        
        PID:9144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55731.exe
        9⤵
        
        PID:13140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16809.exe
        9⤵
        
        PID:13396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48649.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:16192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42834.exe
        8⤵
        
        PID:9964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6913.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27799.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:17260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21577.exe
        7⤵
        
        PID:6800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60427.exe
        7⤵
        
        PID:11776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26321.exe
        7⤵
        
        PID:3704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53563.exe
        6⤵
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57796.exe
        7⤵
        
        PID:8244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10090.exe
        8⤵
        
        PID:13680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43853.exe
        8⤵
        
        PID:1764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32082.exe
        7⤵
        
        PID:12180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41053.exe
        7⤵
        
        PID:2148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9561.exe
        6⤵
        
        PID:8604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35034.exe
        6⤵
        
        PID:6236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2581.exe
        6⤵
        
        PID:6464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29042.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31908.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26340.exe
        7⤵
        
        PID:4024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62764.exe
        8⤵
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61252.exe
        9⤵
        
        PID:9084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47755.exe
        9⤵
        
        PID:12972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24517.exe
        9⤵
        
        PID:15308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64163.exe
        8⤵
        
        PID:8612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54370.exe
        8⤵
        
        PID:10812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24517.exe
        8⤵
        
        PID:15160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1097.exe
        7⤵
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44724.exe
        8⤵
        
        PID:8960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15938.exe
        8⤵
        
        PID:11412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41443.exe
        8⤵
        
        PID:1552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39984.exe
        8⤵
        
        PID:1344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12274.exe
        7⤵
        
        PID:9632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52058.exe
        7⤵
        
        PID:12520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13648.exe
        7⤵
        
        PID:16024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23386.exe
        6⤵
        
        PID:2216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38644.exe
        7⤵
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17132.exe
        8⤵
        
        PID:4772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57516.exe
        9⤵
        
        PID:7124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42386.exe
        9⤵
        
        PID:1436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39984.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:16140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37458.exe
        8⤵
        
        PID:9524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50058.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41583.exe
        8⤵
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52435.exe
        7⤵
        
        PID:6632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22068.exe
        8⤵
        
        PID:13428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43853.exe
        8⤵
        
        PID:16244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25537.exe
        7⤵
        
        PID:10292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54203.exe
        7⤵
        
        PID:14360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48682.exe
        7⤵
        
        PID:8716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29353.exe
        6⤵
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57988.exe
        7⤵
        
        PID:8208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2275.exe
        8⤵
        
        PID:12612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41053.exe
        8⤵
        
        PID:5008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32082.exe
        7⤵
        
        PID:12172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39984.exe
        7⤵
        
        PID:16092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29659.exe
        6⤵
        
        PID:8692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18425.exe
        6⤵
        
        PID:12696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3716.exe
        6⤵
        
        PID:6844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9441.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51036.exe
        6⤵
        
        PID:4760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38068.exe
        7⤵
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15315.exe
        8⤵
        
        PID:6352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46748.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:10176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59867.exe
        9⤵
        
        PID:4408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1943.exe
        9⤵
        
        PID:904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2290.exe
        8⤵
        
        PID:8932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58994.exe
        8⤵
        
        PID:1388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41090.exe
        7⤵
        
        PID:7892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46764.exe
        8⤵
        
        PID:13096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42784.exe
        8⤵
        
        PID:16004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27561.exe
        7⤵
        
        PID:10124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16626.exe
        7⤵
        
        PID:15312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27151.exe
        7⤵
        
        PID:4612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47907.exe
        6⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60956.exe
        7⤵
        
        PID:7980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19689.exe
        7⤵
        
        PID:12256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48152.exe
        7⤵
        
        PID:4936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38594.exe
        6⤵
        
        PID:8880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33531.exe
        6⤵
        
        PID:11640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26321.exe
        6⤵
        
        PID:14852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36816.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42987.exe
        5⤵
        
        PID:2772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38260.exe
        6⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36068.exe
        7⤵
        
        PID:8044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5731.exe
        8⤵
        
        PID:13436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50952.exe
        8⤵
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55626.exe
        7⤵
        
        PID:12736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39984.exe
        7⤵
        
        PID:16176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21594.exe
        6⤵
        
        PID:8148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28617.exe
        6⤵
        
        PID:14132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31616.exe
        6⤵
        
        PID:7412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26745.exe
        5⤵
        
        PID:6044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9674.exe
        6⤵
        
        PID:9228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28817.exe
        6⤵
        
        PID:13160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24517.exe
        6⤵
        
        PID:15376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35978.exe
        5⤵
        
        PID:8860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27404.exe
        5⤵
        
        PID:6376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1512.exe
        5⤵
        
        PID:5700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42202.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42202.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23252.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30860.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35276.exe
        7⤵
        
        PID:4012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60180.exe
        8⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7147.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-355.exe
        10⤵
        
        PID:12524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16746.exe
        10⤵
        
        PID:15336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41053.exe
        10⤵
        
        PID:14536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4786.exe
        9⤵
        
        PID:9892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22873.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:14460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7112.exe
        9⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41090.exe
        8⤵
        
        PID:7908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52066.exe
        8⤵
        
        PID:9256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33731.exe
        8⤵
        
        PID:15152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56128.exe
        8⤵
        
        PID:15196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48291.exe
        7⤵
        
        PID:3708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26882.exe
        8⤵
        
        PID:10136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16425.exe
        8⤵
        
        PID:11508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27799.exe
        8⤵
        
        PID:17324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23793.exe
        7⤵
        
        PID:8680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53169.exe
        8⤵
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59763.exe
        7⤵
        
        PID:12656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24177.exe
        7⤵
        
        PID:15908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64611.exe
        6⤵
        
        PID:3660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53828.exe
        7⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60956.exe
        8⤵
        
        PID:8016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38714.exe
        8⤵
        
        PID:11788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41583.exe
        8⤵
        
        PID:2268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31298.exe
        7⤵
        
        PID:8752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30117.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54370.exe
        7⤵
        
        PID:11924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5809.exe
        6⤵
        
        PID:6636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60764.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55626.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17202.exe
        7⤵
        
        PID:14996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41583.exe
        7⤵
        
        PID:16232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45035.exe
        6⤵
        
        PID:9056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57346.exe
        6⤵
        
        PID:11736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32351.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27522.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19516.exe
        6⤵
        
        PID:1860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45660.exe
        7⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7339.exe
        8⤵
        
        PID:6256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65124.exe
        9⤵
        
        PID:13924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12712.exe
        9⤵
        
        PID:6904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11802.exe
        8⤵
        
        PID:10296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57274.exe
        8⤵
        
        PID:14780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49718.exe
        8⤵
        
        PID:14844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41090.exe
        7⤵
        
        PID:7884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24711.exe
        8⤵
        
        PID:13572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19201.exe
        7⤵
        
        PID:11220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31964.exe
        7⤵
        
        PID:15396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36015.exe
        7⤵
        
        PID:16472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48386.exe
        6⤵
        
        PID:1052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35050.exe
        7⤵
        
        PID:10184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16425.exe
        7⤵
        
        PID:11356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36395.exe
        6⤵
        
        PID:9820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3537.exe
        6⤵
        
        PID:13824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39592.exe
        6⤵
        
        PID:4496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46250.exe
        5⤵
        
        PID:1668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18572.exe
        6⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28388.exe
        7⤵
        
        PID:9040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13930.exe
        7⤵
        
        PID:12320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39984.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7946.exe
        6⤵
        
        PID:7692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59762.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48346.exe
        6⤵
        
        PID:15816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36816.exe
        6⤵
        
        PID:6180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62027.exe
        5⤵
        
        PID:6568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9674.exe
        6⤵
        
        PID:9236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3929.exe
        6⤵
        
        PID:13084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41583.exe
        6⤵
        
        PID:15380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46074.exe
        5⤵
        
        PID:7660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9098.exe
        5⤵
        
        PID:12884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62849.exe
        5⤵
        
        PID:6948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49602.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49602.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39604.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36620.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37876.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39628.exe
        8⤵
        
        PID:6332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42156.exe
        9⤵
        
        PID:10656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39984.exe
        9⤵
        
        PID:4708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62155.exe
        8⤵
        
        PID:7108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16625.exe
        8⤵
        
        PID:14576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49718.exe
        8⤵
        
        PID:2604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41090.exe
        7⤵
        
        PID:7916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30117.exe
        8⤵
        
        PID:1788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19201.exe
        7⤵
        
        PID:11248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33731.exe
        7⤵
        
        PID:15192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48152.exe
        7⤵
        
        PID:14416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48291.exe
        6⤵
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40972.exe
        7⤵
        
        PID:7496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17972.exe
        8⤵
        
        PID:14732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30117.exe
        8⤵
        
        PID:14804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52363.exe
        7⤵
        
        PID:10992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59002.exe
        7⤵
        
        PID:15096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48649.exe
        7⤵
        
        PID:16100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35330.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11226.exe
        6⤵
        
        PID:11696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44466.exe
        6⤵
        
        PID:12584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27016.exe
        6⤵
        
        PID:7024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24922.exe
        5⤵
        
        PID:4768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21156.exe
        6⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7147.exe
        7⤵
        
        PID:5508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37216.exe
        8⤵
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60042.exe
        7⤵
        
        PID:9804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41899.exe
        7⤵
        
        PID:15252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48152.exe
        7⤵
        
        PID:1224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41090.exe
        6⤵
        
        PID:7840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52066.exe
        6⤵
        
        PID:8736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33731.exe
        6⤵
        
        PID:15164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41053.exe
        6⤵
        
        PID:14748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5809.exe
        5⤵
        
        PID:6644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28388.exe
        6⤵
        
        PID:9000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65126.exe
        7⤵
        
        PID:11972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13930.exe
        6⤵
        
        PID:11692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39984.exe
        6⤵
        
        PID:15936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35243.exe
        5⤵
        
        PID:9360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2857.exe
        5⤵
        
        PID:12932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35127.exe
        5⤵
        
        PID:14760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56443.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56443.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52956.exe
        5⤵
        
        PID:2944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60180.exe
        6⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31652.exe
        7⤵
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40708.exe
        8⤵
        
        PID:10792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24517.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12954.exe
        7⤵
        
        PID:10080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-481.exe
        7⤵
        
        PID:14520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48649.exe
        7⤵
        
        PID:16216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41090.exe
        6⤵
        
        PID:7868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52066.exe
        6⤵
        
        PID:10784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17010.exe
        6⤵
        
        PID:14288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41053.exe
        6⤵
        
        PID:15536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63762.exe
        5⤵
        
        PID:6260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3499.exe
        6⤵
        
        PID:8500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65508.exe
        7⤵
        
        PID:12568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41053.exe
        7⤵
        
        PID:3816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30073.exe
        6⤵
        
        PID:13616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39984.exe
        6⤵
        
        PID:16160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46675.exe
        5⤵
        
        PID:9856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3537.exe
        5⤵
        
        PID:13860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26537.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26537.exe
      4⤵
      PID:3136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44036.exe
        5⤵
        
        PID:5976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31652.exe
        6⤵
        
        PID:5620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12954.exe
        6⤵
        
        PID:10048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17009.exe
        6⤵
        
        PID:14672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48649.exe
        6⤵
        
        PID:16044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41090.exe
        5⤵
        
        PID:7924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38418.exe
        5⤵
        
        PID:11656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41053.exe
        5⤵
        
        PID:4904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52587.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52587.exe
      4⤵
      PID:6480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28388.exe
        5⤵
        
        PID:8992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38242.exe
        5⤵
        
        PID:11712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48152.exe
        5⤵
        
        PID:15956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38244.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38244.exe
      4⤵
      PID:8936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29137.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29137.exe
      4⤵
      PID:12784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39313.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39313.exe
      4⤵
      PID:7056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24034.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24034.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53708.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53708.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15275.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6739.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8571.exe
        7⤵
        
        PID:3696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21260.exe
        8⤵
        
        PID:6544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8787.exe
        9⤵
        
        PID:6660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23914.exe
        9⤵
        
        PID:12224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23647.exe
        9⤵
        
        PID:6176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35138.exe
        8⤵
        
        PID:9124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36602.exe
        8⤵
        
        PID:12812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48346.exe
        8⤵
        
        PID:15852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7112.exe
        8⤵
        
        PID:4428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24938.exe
        7⤵
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53276.exe
        8⤵
        
        PID:8836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40634.exe
        8⤵
        
        PID:4076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48152.exe
        8⤵
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29761.exe
        7⤵
        
        PID:9408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20074.exe
        7⤵
        
        PID:13288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48682.exe
        7⤵
        
        PID:6908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42898.exe
        6⤵
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31652.exe
        7⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30117.exe
        8⤵
        
        PID:908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2673.exe
        7⤵
        
        PID:10332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41899.exe
        7⤵
        
        PID:15236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41053.exe
        7⤵
        
        PID:924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54826.exe
        6⤵
        
        PID:7876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18050.exe
        6⤵
        
        PID:6552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14717.exe
        6⤵
        
        PID:1012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13106.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28364.exe
        6⤵
        
        PID:4620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24636.exe
        7⤵
        
        PID:7440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60339.exe
        7⤵
        
        PID:10984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18074.exe
        7⤵
        
        PID:15320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39984.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30530.exe
        6⤵
        
        PID:7476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54562.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27178.exe
        6⤵
        
        PID:16512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23385.exe
        5⤵
        
        PID:5912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31652.exe
        6⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23396.exe
        7⤵
        
        PID:9852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24025.exe
        7⤵
        
        PID:14728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30203.exe
        7⤵
        
        PID:15564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41053.exe
        7⤵
        
        PID:5376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35346.exe
        6⤵
        
        PID:11144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7306.exe
        6⤵
        
        PID:15124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42378.exe
        6⤵
        
        PID:15556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57338.exe
        6⤵
        
        PID:14932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60691.exe
        5⤵
        
        PID:7944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49718.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32929.exe
        5⤵
        
        PID:10264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41202.exe
        5⤵
        
        PID:11724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1512.exe
        5⤵
        
        PID:5332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26074.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26074.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32972.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45276.exe
        6⤵
        
        PID:5208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9731.exe
        7⤵
        
        PID:7032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58620.exe
        8⤵
        
        PID:15488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13205.exe
        8⤵
        
        PID:15916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12762.exe
        7⤵
        
        PID:9828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50058.exe
        7⤵
        
        PID:11156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64793.exe
        7⤵
        
        PID:15472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29082.exe
        6⤵
        
        PID:7484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38516.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14764
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14764 -s 492
        8⤵
        Program crash
        
        PID:15788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35313.exe
        7⤵
        
        PID:16992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-561.exe
        6⤵
        
        PID:10868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31427.exe
        6⤵
        
        PID:14928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39984.exe
        6⤵
        
        PID:5956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1394.exe
        5⤵
        
        PID:6532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49820.exe
        6⤵
        
        PID:8100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42416.exe
        7⤵
        
        PID:6880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32082.exe
        6⤵
        
        PID:12164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39984.exe
        6⤵
        
        PID:16164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47722.exe
        5⤵
        
        PID:8640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26515.exe
        5⤵
        
        PID:13068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48682.exe
        5⤵
        
        PID:9952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43370.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43370.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12411.exe
        5⤵
        
        PID:5184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30780.exe
        6⤵
        
        PID:6652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61252.exe
        7⤵
        
        PID:9076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48523.exe
        7⤵
        
        PID:12596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39984.exe
        7⤵
        
        PID:1988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-842.exe
        6⤵
        
        PID:9664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7769.exe
        6⤵
        
        PID:12876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48152.exe
        6⤵
        
        PID:5256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21577.exe
        5⤵
        
        PID:6540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44283.exe
        5⤵
        
        PID:11648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41583.exe
        5⤵
        
        PID:1108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37217.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37217.exe
      4⤵
      PID:7040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5227.exe
        5⤵
        
        PID:8868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55731.exe
        5⤵
        
        PID:13092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31043.exe
        5⤵
        
        PID:14652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48152.exe
        5⤵
        
        PID:4848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50883.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50883.exe
      4⤵
      PID:9528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20491.exe
      4⤵
      PID:11932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1512.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1512.exe
      4⤵
      PID:6204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47578.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47578.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15275.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15275.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33164.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10875.exe
        6⤵
        
        PID:212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52972.exe
        7⤵
        
        PID:6668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52404.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5466.exe
        8⤵
        
        PID:11208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57378.exe
        8⤵
        
        PID:15148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31616.exe
        8⤵
        
        PID:8360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39274.exe
        7⤵
        
        PID:9692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12202.exe
        7⤵
        
        PID:14036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56128.exe
        7⤵
        
        PID:16360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59531.exe
        6⤵
        
        PID:7100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29260.exe
        7⤵
        
        PID:9748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58611.exe
        7⤵
        
        PID:13168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41053.exe
        7⤵
        
        PID:5788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14769.exe
        6⤵
        
        PID:9580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13634.exe
        6⤵
        
        PID:13380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39592.exe
        6⤵
        
        PID:14976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33194.exe
        5⤵
        
        PID:1472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32700.exe
        6⤵
        
        PID:6600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26882.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16425.exe
        7⤵
        
        PID:9996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26647.exe
        7⤵
        
        PID:16544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52155.exe
        6⤵
        
        PID:9872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6337.exe
        6⤵
        
        PID:13808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33113.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7651.exe
        6⤵
        
        PID:10876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2610.exe
        6⤵
        
        PID:14976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24517.exe
        6⤵
        
        PID:15336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64459.exe
        5⤵
        
        PID:10252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37561.exe
        5⤵
        
        PID:14284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24517.exe
        5⤵
        
        PID:5728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62307.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62307.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49538.exe
        5⤵
        
        PID:6280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28876.exe
        6⤵
        
        PID:9612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41122.exe
        6⤵
        
        PID:12488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24517.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54075.exe
        5⤵
        
        PID:10084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20641.exe
        5⤵
        
        PID:14028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24517.exe
        5⤵
        
        PID:15508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13401.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13401.exe
      4⤵
      PID:384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39628.exe
        5⤵
        
        PID:4964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6203.exe
        6⤵
        
        PID:9436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45259.exe
        6⤵
        
        PID:14104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19348.exe
        6⤵
        
        PID:13580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12954.exe
        5⤵
        
        PID:9596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56122.exe
        5⤵
        
        PID:14400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49718.exe
        5⤵
        
        PID:14792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43971.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43971.exe
      4⤵
      PID:7936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16209.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16209.exe
      4⤵
      PID:10528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38042.exe
      4⤵
      PID:15064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14717.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14717.exe
      4⤵
      PID:15212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6842.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6842.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47196.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47196.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52188.exe
        5⤵
        
        PID:5044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52588.exe
        6⤵
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3587.exe
        7⤵
        
        PID:7960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33220.exe
        8⤵
        
        PID:13172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49718.exe
        8⤵
        
        PID:3636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13826.exe
        7⤵
        
        PID:10000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10761.exe
        7⤵
        
        PID:15320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48682.exe
        7⤵
        
        PID:1392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49747.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54370.exe
        6⤵
        
        PID:6300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48682.exe
        6⤵
        
        PID:9976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63762.exe
        5⤵
        
        PID:6152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61252.exe
        6⤵
        
        PID:9024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13930.exe
        6⤵
        
        PID:11740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41053.exe
        6⤵
        
        PID:15032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45130.exe
        5⤵
        
        PID:9816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4298.exe
        5⤵
        
        PID:4796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41391.exe
        5⤵
        
        PID:16028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55011.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55011.exe
      4⤵
      PID:4340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61908.exe
        5⤵
        
        PID:6412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49820.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49718.exe
        7⤵
        
        PID:5016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57163.exe
        6⤵
        
        PID:11768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48152.exe
        6⤵
        
        PID:668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35138.exe
        5⤵
        
        PID:8972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63818.exe
        6⤵
        
        PID:7604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44770.exe
        5⤵
        
        PID:12840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7112.exe
        5⤵
        
        PID:5280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30505.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30505.exe
      4⤵
      PID:6708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52980.exe
        5⤵
        
        PID:7312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16322.exe
        5⤵
        
        PID:11832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48152.exe
        5⤵
        
        PID:5336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28123.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28123.exe
      4⤵
      PID:8924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24865.exe
      4⤵
      PID:11620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61084.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61084.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5977.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5977.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17508.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17508.exe
      4⤵
      PID:4100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43460.exe
        5⤵
        
        PID:6324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40780.exe
        6⤵
        
        PID:7568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52363.exe
        6⤵
        
        PID:10848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17969.exe
        6⤵
        
        PID:15076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49718.exe
        6⤵
        
        PID:7068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21594.exe
        5⤵
        
        PID:8132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5361.exe
        5⤵
        
        PID:11752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56658.exe
        5⤵
        
        PID:16308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58187.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58187.exe
      4⤵
      PID:6488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8787.exe
        5⤵
        
        PID:7672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24874.exe
        5⤵
        
        PID:12140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24517.exe
        5⤵
        
        PID:4168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47722.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47722.exe
      4⤵
      PID:8600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9794.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9794.exe
      4⤵
      PID:13124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27151.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27151.exe
      4⤵
      PID:5984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34610.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34610.exe
    3⤵
    PID:1272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34650.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34650.exe
      4⤵
      PID:6052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5227.exe
        5⤵
        
        PID:9136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15082.exe
        5⤵
        
        PID:13024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16233.exe
        5⤵
        
        PID:12984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49718.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6025.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6025.exe
      4⤵
      PID:9836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61403.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61403.exe
      4⤵
      PID:13992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48152.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48152.exe
      4⤵
      PID:14284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28236.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28236.exe
    3⤵
    PID:6700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26882.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26882.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16425.exe
      4⤵
      PID:11348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48338.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48338.exe
      4⤵
      PID:16292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48682.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48682.exe
      4⤵
      PID:5988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23921.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23921.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:8700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65219.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65219.exe
    3⤵
    PID:13060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36513.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36513.exe
    3⤵
    PID:6396
- C:\Users\Admin\AppData\Local\Temp\Unicorn-2706.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-2706.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11227.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11227.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53708.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53708.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7299.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32972.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49538.exe
        7⤵
        
        PID:6268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61252.exe
        8⤵
        
        PID:9104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46027.exe
        8⤵
        
        PID:12480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24517.exe
        8⤵
        
        PID:15368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20442.exe
        7⤵
        
        PID:9672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3537.exe
        7⤵
        
        PID:13816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23448.exe
        7⤵
        
        PID:16184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40314.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65284.exe
        7⤵
        
        PID:7336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52363.exe
        7⤵
        
        PID:10856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25561.exe
        7⤵
        
        PID:14936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56817.exe
        7⤵
        
        PID:7296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43306.exe
        6⤵
        
        PID:7744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11226.exe
        6⤵
        
        PID:11744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19961.exe
        6⤵
        
        PID:4636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14717.exe
        6⤵
        
        PID:16224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37802.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53636.exe
        6⤵
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24060.exe
        7⤵
        
        PID:7392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65508.exe
        8⤵
        
        PID:12556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-410.exe
        8⤵
        
        PID:880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41053.exe
        8⤵
        
        PID:9312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27666.exe
        7⤵
        
        PID:11004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59002.exe
        7⤵
        
        PID:15108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49718.exe
        7⤵
        
        PID:3628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30530.exe
        6⤵
        
        PID:7460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30057.exe
        6⤵
        
        PID:11792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41053.exe
        6⤵
        
        PID:15136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61642.exe
        5⤵
        
        PID:5468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49820.exe
        6⤵
        
        PID:7968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41580.exe
        7⤵
        
        PID:12940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49718.exe
        7⤵
        
        PID:15128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40634.exe
        6⤵
        
        PID:10376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27547.exe
        5⤵
        
        PID:7092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8721.exe
        5⤵
        
        PID:11864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14717.exe
        5⤵
        
        PID:16348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3578.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3578.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16636.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53636.exe
        6⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40868.exe
        7⤵
        
        PID:6556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26882.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16425.exe
        8⤵
        
        PID:10536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48649.exe
        8⤵
        
        PID:15960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27650.exe
        7⤵
        
        PID:9896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6337.exe
        7⤵
        
        PID:13780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13706.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30620.exe
        7⤵
        
        PID:12724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43853.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11505.exe
        6⤵
        
        PID:10364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61795.exe
        6⤵
        
        PID:14436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48152.exe
        6⤵
        
        PID:13768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24362.exe
        5⤵
        
        PID:5584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65284.exe
        6⤵
        
        PID:7348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17972.exe
        7⤵
        
        PID:14292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35784.exe
        7⤵
        
        PID:5140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3162.exe
        6⤵
        
        PID:10892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41583.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43306.exe
        5⤵
        
        PID:7760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60028.exe
        6⤵
        
        PID:12672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64793.exe
        6⤵
        
        PID:5260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60427.exe
        5⤵
        
        PID:11760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27151.exe
        5⤵
        
        PID:5356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51538.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51538.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1939.exe
        5⤵
        
        PID:4452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24636.exe
        6⤵
        
        PID:7432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20060.exe
        7⤵
        
        PID:14196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44666.exe
        6⤵
        
        PID:11608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9714.exe
        6⤵
        
        PID:14292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48682.exe
        6⤵
        
        PID:16064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63203.exe
        5⤵
        
        PID:7288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4122.exe
        5⤵
        
        PID:10752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41583.exe
        5⤵
        
        PID:14560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37995.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37995.exe
      4⤵
      PID:5552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8787.exe
        5⤵
        
        PID:7632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24874.exe
        5⤵
        
        PID:12116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34065.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34065.exe
      4⤵
      PID:8576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11363.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11363.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26016.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26016.exe
      4⤵
      PID:5312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17506.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17506.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56116.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56116.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32972.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44124.exe
        6⤵
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32612.exe
        7⤵
        
        PID:7520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39476.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29048.exe
        8⤵
        
        PID:16068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38034.exe
        7⤵
        
        PID:10432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40554.exe
        7⤵
        
        PID:14744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49718.exe
        7⤵
        
        PID:15524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48874.exe
        6⤵
        
        PID:9052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30117.exe
        7⤵
        
        PID:1760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34299.exe
        6⤵
        
        PID:12892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24026.exe
        6⤵
        
        PID:16272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48682.exe
        6⤵
        
        PID:6356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39546.exe
        5⤵
        
        PID:5896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19732.exe
        6⤵
        
        PID:7332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57163.exe
        6⤵
        
        PID:11852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49718.exe
        6⤵
        
        PID:1592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22257.exe
        5⤵
        
        PID:8940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29281.exe
        5⤵
        
        PID:11688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40514.exe
        5⤵
        
        PID:16120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37802.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37802.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45276.exe
        5⤵
        
        PID:5216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49036.exe
        6⤵
        
        PID:6456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29068.exe
        7⤵
        
        PID:9560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50827.exe
        7⤵
        
        PID:13508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41053.exe
        7⤵
        
        PID:15632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27650.exe
        6⤵
        
        PID:9904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6337.exe
        6⤵
        
        PID:13868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3234.exe
        5⤵
        
        PID:6436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16308.exe
        6⤵
        
        PID:12540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41053.exe
        6⤵
        
        PID:3560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42258.exe
        5⤵
        
        PID:10268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29507.exe
        5⤵
        
        PID:14340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41053.exe
        5⤵
        
        PID:16320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48274.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48274.exe
      4⤵
      PID:5884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40780.exe
        5⤵
        
        PID:7584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37216.exe
        6⤵
        
        PID:5284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21698.exe
        5⤵
        
        PID:10452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40554.exe
        5⤵
        
        PID:14752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49718.exe
        5⤵
        
        PID:15388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41195.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41195.exe
      4⤵
      PID:8064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2561.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2561.exe
      4⤵
      PID:11728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14717.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14717.exe
      4⤵
      PID:15840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39810.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39810.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31052.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31052.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17508.exe
        5⤵
        
        PID:2752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10787.exe
        6⤵
        
        PID:2688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58875.exe
        7⤵
        
        PID:9272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12778.exe
        7⤵
        
        PID:13904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48152.exe
        7⤵
        
        PID:15972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10058.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42955.exe
        6⤵
        
        PID:13684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31616.exe
        6⤵
        
        PID:8276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50787.exe
        5⤵
        
        PID:7000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28388.exe
        6⤵
        
        PID:8984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55316.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3658.exe
        7⤵
        
        PID:15004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42784.exe
        7⤵
        
        PID:4060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40058.exe
        6⤵
        
        PID:10772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23448.exe
        6⤵
        
        PID:16072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45330.exe
        5⤵
        
        PID:9480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12674.exe
        5⤵
        
        PID:12628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48682.exe
        5⤵
        
        PID:6912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64715.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64715.exe
      4⤵
      PID:3500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52972.exe
        5⤵
        
        PID:6676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36556.exe
        6⤵
        
        PID:8892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13930.exe
        6⤵
        
        PID:11636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39984.exe
        6⤵
        
        PID:16108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15642.exe
        5⤵
        
        PID:9352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22761.exe
        5⤵
        
        PID:12900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31616.exe
        5⤵
        
        PID:9212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65098.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65098.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49820.exe
        5⤵
        
        PID:7620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54306.exe
        6⤵
        
        PID:15760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24874.exe
        5⤵
        
        PID:12132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41053.exe
        5⤵
        
        PID:14384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54163.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54163.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26017.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26017.exe
      4⤵
      PID:13004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18983.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18983.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:16056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16562.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16562.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2131.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2131.exe
      4⤵
      PID:4908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32036.exe
        5⤵
        
        PID:6368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45819.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56122.exe
        5⤵
        
        PID:14188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49718.exe
        5⤵
        
        PID:16372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16778.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16778.exe
      4⤵
      PID:8084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61491.exe
      4⤵
      PID:11956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41583.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41583.exe
      4⤵
      PID:14732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35577.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35577.exe
    3⤵
    PID:5500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6187.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6187.exe
      4⤵
      PID:6748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43588.exe
        5⤵
        
        PID:1908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64986.exe
        5⤵
        
        PID:15764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49718.exe
        5⤵
        
        PID:15232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45819.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45819.exe
      4⤵
      PID:9344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26521.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26521.exe
      4⤵
      PID:14840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41053.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41053.exe
      4⤵
      PID:5100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59611.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59611.exe
    3⤵
    PID:2912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52292.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52292.exe
    3⤵
    PID:11916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39313.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39313.exe
    3⤵
    PID:5132
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5097.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5097.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53708.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53708.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56116.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56116.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22884.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8187.exe
        6⤵
        
        PID:844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45572.exe
        7⤵
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44724.exe
        8⤵
        
        PID:9008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21521.exe
        8⤵
        
        PID:13596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48152.exe
        8⤵
        
        PID:2112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51475.exe
        7⤵
        
        PID:8908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52938.exe
        7⤵
        
        PID:12804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24517.exe
        7⤵
        
        PID:9848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16578.exe
        6⤵
        
        PID:6768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44812.exe
        7⤵
        
        PID:3488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57163.exe
        7⤵
        
        PID:11900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31616.exe
        7⤵
        
        PID:9204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22257.exe
        6⤵
        
        PID:8916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57843.exe
        6⤵
        
        PID:11684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48682.exe
        6⤵
        
        PID:9984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10610.exe
        5⤵
        
        PID:5656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31652.exe
        6⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46852.exe
        7⤵
        
        PID:9324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20754.exe
        7⤵
        
        PID:14180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50952.exe
        7⤵
        
        PID:6928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2673.exe
        6⤵
        
        PID:10424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41899.exe
        6⤵
        
        PID:15244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41053.exe
        6⤵
        
        PID:16272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54826.exe
        5⤵
        
        PID:7828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46492.exe
        6⤵
        
        PID:13024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30117.exe
        6⤵
        
        PID:2452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41595.exe
        5⤵
        
        PID:10360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25065.exe
        5⤵
        
        PID:15208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31424.exe
        5⤵
        
        PID:6468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62499.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62499.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43164.exe
        5⤵
        
        PID:4344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56820.exe
        6⤵
        
        PID:7160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16308.exe
        7⤵
        
        PID:12492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13657.exe
        8⤵
        
        PID:6168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49718.exe
        7⤵
        
        PID:5292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12762.exe
        6⤵
        
        PID:9884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15089.exe
        6⤵
        
        PID:14060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49718.exe
        6⤵
        
        PID:1664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20914.exe
        5⤵
        
        PID:7576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1369.exe
        6⤵
        
        PID:15368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62017.exe
        6⤵
        
        PID:6952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-561.exe
        5⤵
        
        PID:10880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23259.exe
        5⤵
        
        PID:14992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48682.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29545.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29545.exe
      4⤵
      PID:6032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49820.exe
        5⤵
        
        PID:7540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14971.exe
        6⤵
        
        PID:14688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30117.exe
        6⤵
        
        PID:2260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24874.exe
        5⤵
        
        PID:12124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24517.exe
        5⤵
        
        PID:1672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36473.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36473.exe
      4⤵
      PID:9700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13322.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13322.exe
      4⤵
      PID:10968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20052.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20052.exe
      4⤵
      PID:10556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52779.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52779.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54627.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54627.exe
      4⤵
      PID:396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35484.exe
        5⤵
        
        PID:336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8211.exe
        6⤵
        
        PID:7952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46882.exe
        6⤵
        
        PID:11588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56315.exe
        6⤵
        
        PID:15804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41583.exe
        6⤵
        
        PID:15412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8522.exe
        5⤵
        
        PID:8948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27665.exe
        5⤵
        
        PID:11596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17078.exe
        5⤵
        
        PID:10572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15129.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15129.exe
      4⤵
      PID:6524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49820.exe
        5⤵
        
        PID:8232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63980.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49718.exe
        6⤵
        
        PID:3104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32082.exe
        5⤵
        
        PID:12188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12977.exe
        5⤵
        
        PID:15344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48649.exe
        5⤵
        
        PID:16264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54739.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54739.exe
      4⤵
      PID:9168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48152.exe
        5⤵
        
        PID:4020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41970.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41970.exe
      4⤵
      PID:12848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2647.exe
      4⤵
      PID:6400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51538.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51538.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20196.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20196.exe
      4⤵
      PID:4944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15315.exe
        5⤵
        
        PID:1676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16500.exe
        6⤵
        
        PID:12308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49718.exe
        6⤵
        
        PID:2800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2673.exe
        5⤵
        
        PID:10316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6729.exe
        6⤵
        
        PID:15528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41899.exe
        5⤵
        
        PID:15228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48152.exe
        5⤵
        
        PID:2948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41090.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41090.exe
      4⤵
      PID:7900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19201.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19201.exe
      4⤵
      PID:11240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33731.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33731.exe
      4⤵
      PID:15172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41053.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41053.exe
      4⤵
      PID:3856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54139.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54139.exe
    3⤵
    PID:5872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31652.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31652.exe
      4⤵
      PID:5652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13205.exe
        5⤵
        
        PID:5416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61963.exe
      4⤵
      PID:9576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50058.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50058.exe
      4⤵
      PID:13696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48682.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48682.exe
      4⤵
      PID:10228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52026.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52026.exe
    3⤵
    PID:7852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14971.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14971.exe
      4⤵
      PID:14792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29048.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29048.exe
      4⤵
      PID:16148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8226.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8226.exe
    3⤵
    PID:9284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25596.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25596.exe
    3⤵
    PID:15200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35127.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35127.exe
    3⤵
    PID:16344
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37107.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37107.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56308.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56308.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-491.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28364.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57116.exe
        6⤵
        
        PID:7380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60339.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17969.exe
        6⤵
        
        PID:15068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49718.exe
        6⤵
        
        PID:3444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13225.exe
        5⤵
        
        PID:9160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15154.exe
        5⤵
        
        PID:14208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14717.exe
        5⤵
        
        PID:6196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9650.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9650.exe
      4⤵
      PID:5904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36068.exe
        5⤵
        
        PID:8032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40826.exe
        5⤵
        
        PID:11820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31433.exe
        5⤵
        
        PID:15416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2437.exe
        5⤵
        
        PID:17004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20529.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20529.exe
      4⤵
      PID:8624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30117.exe
        5⤵
        
        PID:15476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60235.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60235.exe
      4⤵
      PID:9248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27151.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27151.exe
      4⤵
      PID:5348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54139.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54139.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45276.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45276.exe
      4⤵
      PID:5224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8579.exe
        5⤵
        
        PID:6688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12539.exe
        6⤵
        
        PID:9640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58139.exe
        6⤵
        
        PID:13848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43853.exe
        6⤵
        
        PID:916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43026.exe
        5⤵
        
        PID:8828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16425.exe
        5⤵
        
        PID:13140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32313.exe
        5⤵
        
        PID:6308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46571.exe
      4⤵
      PID:7088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9585.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9585.exe
      4⤵
      PID:10320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61411.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61411.exe
      4⤵
      PID:14376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41583.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41583.exe
      4⤵
      PID:5776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23385.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23385.exe
    3⤵
    PID:5920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40972.exe
      4⤵
      PID:7548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60206.exe
        5⤵
        
        PID:6656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27282.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27282.exe
      4⤵
      PID:10816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33921.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33921.exe
      4⤵
      PID:14904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49718.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49718.exe
      4⤵
      PID:14964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20801.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20801.exe
    3⤵
    PID:8668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50131.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50131.exe
    3⤵
    PID:13076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1512.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1512.exe
    3⤵
    PID:8452
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14705.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14705.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6739.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6739.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9531.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9531.exe
      4⤵
      PID:1380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27700.exe
        5⤵
        
        PID:5128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-427.exe
        6⤵
        
        PID:2636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32082.exe
        6⤵
        
        PID:12156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12977.exe
        6⤵
        
        PID:12880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49718.exe
        6⤵
        
        PID:880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33410.exe
        5⤵
        
        PID:8852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29673.exe
        5⤵
        
        PID:11376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40514.exe
        5⤵
        
        PID:5748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42042.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50707.exe
        5⤵
        
        PID:9260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12778.exe
        5⤵
        
        PID:13896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41053.exe
        5⤵
        
        PID:14992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47059.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47059.exe
      4⤵
      PID:9932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3537.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3537.exe
      4⤵
      PID:13796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31616.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31616.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:16084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10226.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10226.exe
    3⤵
    PID:5524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7147.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7147.exe
      4⤵
      PID:5676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30812.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24517.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4786.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4786.exe
      4⤵
      PID:9864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22873.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22873.exe
      4⤵
      PID:14468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49718.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49718.exe
      4⤵
      PID:15800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54826.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54826.exe
    3⤵
    PID:7860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25067.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25067.exe
    3⤵
    PID:11260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25065.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25065.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:15184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27178.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27178.exe
    3⤵
    PID:16504
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22114.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22114.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20196.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20196.exe
    3⤵
    PID:4304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57116.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57116.exe
      4⤵
      PID:7324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37216.exe
        5⤵
        
        PID:1712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23042.exe
      4⤵
      PID:10396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33153.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33153.exe
      4⤵
      PID:14500
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30530.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30530.exe
    3⤵
    PID:7492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52747.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52747.exe
    3⤵
    PID:10764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20052.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20052.exe
    3⤵
    PID:15172
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21691.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21691.exe
  2⤵
  PID:5516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36068.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36068.exe
    3⤵
    PID:8052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37216.exe
      4⤵
      PID:5264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24682.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24682.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:11672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24517.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24517.exe
    3⤵
    PID:4352
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13065.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13065.exe
  2⤵
  PID:8584
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25234.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25234.exe
  2⤵
  PID:10008
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4186.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4186.exe
  2⤵
  PID:4816
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55649.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55649.exe
  2⤵
  PID:15816

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11227.exe

Filesize
468KB

MD5
46d301d7ba5d86b6f92bd1b3b2cf7e8c

SHA1
542af80a0d236d76e2ea4402daaf6f71ae64a37c

SHA256
25da4a4a994cef460c3f19e6c53c834f16fc35adbbcd3bee681974f0204d92f3

SHA512
26254d4315665f64241cfde7a1a54cae17e78953ec9b58ddae50f0c2bda59fddc9f68dca7b01e2ab0eb9b839a6e3cd7a7508f286bc57a0943fd3a5d44e960461

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12042.exe

Filesize
468KB

MD5
f8819ddfd55e549a337f06e7e010339d

SHA1
56341bdc6c8a702c2c6a139dcde70d521b09f67d

SHA256
3398f2f38064ca5f4dc54106f0cd1db3c1250e43220e92cf10650a3ad9c6812c

SHA512
4c00b75e9b693ec949f807a94298522148dc85eccae16688eb376d6d5f47383a2aab51c5bb11320514c37da44ea189857ee1268d4c20aa61278a7e7136053c91

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14705.exe

Filesize
468KB

MD5
e247f983c7021901c9e876c8d1a33175

SHA1
8bdd91cbb1739c4ca1e6e3a57eca8894bbe56642

SHA256
7ad63f29db22bb5549c468f968bfce6a21c3e316ee3d414915ffbfbd444a73ed

SHA512
8a6d711294f1d986e7eed37ad9cf5f30d5be2c50b5e1ab974b583a6645df3266990840818e225bd27dca4838a26f365f7c6691b674eefdfc9a482f266ae29b12

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15275.exe

Filesize
468KB

MD5
e045c890a2b7eefc89918c72c11f3e8f

SHA1
89b7cb68caa618687e15874277482cea4babd906

SHA256
72e767ac232ca4d3015b294fdb0fd87d21609c244b4aab7de10261f298a55582

SHA512
4b9c26f9c0f58c275146bb9d1d7691b98596b15ccb1d1e69bbd76638188f4996ccbf5f3423d02e7cf14d31f78d8c7e63264175400d3906b70c8422bd8f2e213b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15660.exe

Filesize
468KB

MD5
e0896951d9783370a9eb2a25045da761

SHA1
ac6fed187df2b794981b5420a1773784c7ac81a0

SHA256
990d62e24289843053d8801be0b3eca705dfa0c5316d7e0e2ecdb9caeedc23cd

SHA512
de75c9b7e7f9308d50989c2ecadd3fa1d283a661233583d677406cd3d483536b2a264f1249a6d6e24bb8116283167b29a1d7df0494ec39a99d58bf05c859b93c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17506.exe

Filesize
468KB

MD5
41734d6cf49d4aebf6c204306c87f846

SHA1
5f9b8f4829fb435a91cc2d6bc9a8a14d60af2161

SHA256
6fbf62ac5f939de75c5c12f140b7d5e2dd35cecf5ca256b0123bb9ddcfbbb430

SHA512
01ef1721fb592802086729e5526e2cea2595ad7d857bd2498fb464737b610514732b27d5141bce2d034eeb4ff67fdb4c180178f91743b538c09dacf5fdbed689

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-195.exe

Filesize
468KB

MD5
ae068a6f299260eec3706ff391f072e2

SHA1
36d1ecfa54f0902ed05f509cc60a699740bb526d

SHA256
b99375b4eaa8bc7f50a5fa4b86fe6b562cb662a3aabde190df57992c3a011d4d

SHA512
dab0156c2aa9c6e31c82501e07480e24055a7d7c2c58966292587c9aec99849f78a0eb2d25e40eb269087e6f5d8732b1dc250c0fe6289f04cc22d212932b384d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23236.exe

Filesize
468KB

MD5
dba9be801b86f8ab6b9b143eb01510aa

SHA1
849053baf8c90405632b64ea0bfe186a2ad9ad66

SHA256
65cf18ffd49d45c21d77ca1b502eb23163e644e7979c832ee27585b30f869fe7

SHA512
43f436d45bc34831e463e105135f9de92ad4b72f1c2cf9f365c4c95ac24fb9378b7608d149874ffe9f37a0fac7acce44591c2b72c1b8c7d2b0eb68b8876d3864

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23252.exe

Filesize
468KB

MD5
032998384064e7f63d2bcdacaaca1728

SHA1
f4158dd9e9ad04fedd620a84b9af92eca8a484ab

SHA256
ea723364ca9c23aae6aa966d1a11eca5a7b9e60755f3a660adeac62635641269

SHA512
2477ebd6da374e41e3e78391cf1162c50fe1503e9c41ca808792ea3de552c14920d01c22b23d3db3e0b2f63807b6feb50e2b7828c64d194f798d23269c932166

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24034.exe

Filesize
468KB

MD5
fd594da31d20b753da0caeb8d2172bf7

SHA1
d4f56d760e30055997dac3d7e11a2436808a24da

SHA256
e3a6ece55decbc1faed16d04ad7e8a6c241e0b1f5463524fa1a944d58e3d2186

SHA512
1345ba02562f0a91c2fa8898b84e9f602bedfce21483d0a33d5abbc70b72139d6854e1a0751997f849aea5d8f4a638514f3a3407bd21dad834b7b66a0b8334b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26074.exe

Filesize
468KB

MD5
7f325c56d51b8f756f94301032f83a9b

SHA1
19d9266f8c9f29d8227a45eac1920c12c5738e5b

SHA256
7200c643f9a7d10d3b3482ea6e3a775b46bce0be5c53b8cef7196c76fa91de2b

SHA512
da06c5e17f854aa90000a7dacfc2effbc1c39b6b76089c6e8e539d7c95b127382f6c37dade9dcf1540c414135b833974d00a7c72cd0bd99e8194a80980f7af7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2706.exe

Filesize
468KB

MD5
41270f81fcbc67100caad747985fac1f

SHA1
8270154425190dfe2c3c997bd962377fbea0700d

SHA256
f3fec59b26f386f111d9204a07ac720c295705626134905f925b5dbd4db77596

SHA512
5b812b4a2675157f1286a9a6cdf560cc3eb2ca376a0b23b905454cf9e14e5903b28931a84b2c26c7d659bc631fa02a890a485608945e7b2d79b5562d84393397

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28817.exe

Filesize
468KB

MD5
03b936fd1686f4e25267081800a24d92

SHA1
15bd9b2dab85846ac8f2ea73a3a55d0e34cb9cc1

SHA256
753551c977ec59ff6c02b3bbadacbc0ef114d4429588a2f5e10fc09e6a059c1d

SHA512
c50b43252028b0d123dcbe6505ced624f6011544e9a70241c96a60ed52c336374ab3d5afea5241cf840d660a9fea176f0e45bf780774dbfe35097e0e56c4f4c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29042.exe

Filesize
468KB

MD5
4fce004428c31370a716559b5175950d

SHA1
5102873ce85cb420e145f388b9671ea6b2c1da1d

SHA256
420903b08d1cbd1fefee29694cb2604b566c3c1530dc4af1361a73f468393688

SHA512
0550509f2305b6078f62ee7aa95f10bcf17856125ad5aade3c7dd1578db30806ad16407f101a57b1fd099d6a1e252a0b220a4c15b9e20721e55094aed829b9d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31908.exe

Filesize
468KB

MD5
54c40ac0731b3a1f565a404408699979

SHA1
ff1eb3ba8a9eaf0f31875efafd6b4df499af0f3f

SHA256
1eb7813b575e722a8f123ad2614d3476807ce371876e270db738346b4a06fd1d

SHA512
97e3d664de4501474a8e3ee4d298d1e4d6c51640b7ea54fccc82154fc037127d17cf62f576e525a39ac4887212b32af6c1d666052eb2d8f800e7c57716a2752b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3578.exe

Filesize
468KB

MD5
4e9b62a0beb9b33196174d917eebb022

SHA1
a748d41e2051f693709afa835d840960eb6bbbbc

SHA256
bbf340ea71e3de3ec88f52fb2940c3935e8b7ff0464223e65af52d45ddb9d45d

SHA512
17b411d6effdc00d6563fe959c17fdc1347668d8429d4e8f37e69dffb54119f6daed0be8446968acc13c5cba402a2a082aac5c1e524ef14a65bffa792784743a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37107.exe

Filesize
468KB

MD5
85a7de2258c2f1f80c34f227ddf3eb55

SHA1
5350abd323d7865f076fded11c6d27fcfda11924

SHA256
45d255cf370a968341523eedce60f341dead68bb7268b8fdc17515af77c46a13

SHA512
f9ff2afae59df66f5d6d4a64e9c372c412dc19cdc302534b94616cad03f5c25c3f7308f17162712dac16b46f07ad5446121f8403f88eea2299e3b19df841c4eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39810.exe

Filesize
468KB

MD5
345c8bea38e87eef98c0240160d6cb79

SHA1
103a40707746cf5f36c01f47bb2bea11273e146b

SHA256
1dfbdac00ba2f7dc6f88f90e216e6dbafcb8e8f20af22f58f48d82528a025e47

SHA512
b4a5c775099c76fc2b9ac07c7f6e5b429c115739817ccf92b04c1adf46c124379ac7ebaebcece3c24587cb6b4404c6a056a46225ac6234f795e9cb233a733997

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42202.exe

Filesize
468KB

MD5
018c47bf56e9dde905e8a6890a7d5a5f

SHA1
a2edeff0ca58e5ac409091d2669f0b5c980ccbe6

SHA256
150e3ab2ecdfcd16e65982458014978dee01e1af6feced853d98ee9219ec7b9c

SHA512
2b817460065f44ec938ada52fc898092e0c3630554b854b19b292871e2a21afc0eb69da72430a04247568c3c98f556dcc251f64330c62cf4d81fe5ea8560af19

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43900.exe

Filesize
468KB

MD5
47102c0ec1cfd47352416c6ac2a4fc8c

SHA1
13d291f262d64a6c8a3607c0087ed878447f1adf

SHA256
06700597f11ba4f5e74a4bd6efb2dc2fba923233601a41f46f67274da77cf0df

SHA512
4a059a3380fb15060582cb68119bf1fe222108dc9b5c0cb3ae2b0ef13ab4e05d64d329f9a4e46e79113180241cbe2748c0231e09288a95a25c31e0949695dbde

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47578.exe

Filesize
468KB

MD5
4fab3d7865b0c8317c29d58c7aed0632

SHA1
4264934b48491832a4a9cea6d84791ad225a9e95

SHA256
770fd00b7ae8bbe29a27809d090b100ce82da700c3d16732b51535596fd42cea

SHA512
2bc11cdd9a1c79e857442cfd7a2f41af39f4962d81ba818d6b08787a1a1eb1bda64924fbaace50871b64b24c2ea4a972ebebd4b39be6b76947ef804efc40aae7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49602.exe

Filesize
468KB

MD5
5015d453e4602a34d2510d1cc8d77fc4

SHA1
5035c56b7e5d108a86c18726e2ca5a266761869e

SHA256
ec6a0afcbb92bf0b477d08c7852b9db04d5ba7b0f2d231f69c3b297a6bd04c9a

SHA512
1fad40d2473363861fd041781f528818d9057b5815700eb7949735f2b788e36c27765109fc1a44d2686de151801f520615d62c8119edb744676e7b5aee2aa671

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5097.exe

Filesize
468KB

MD5
f2f8bb35677e27cbb057f36aa569563a

SHA1
3dd3074eb4c9eeb80550caa8745f9a6f5afc6761

SHA256
f16d669a5f13c649b180ead60c2868da7f25c39778680c65989d883470f5961c

SHA512
bcac0bab8403e9f42fdd1237c33674f66759dffaf11db1a7ba2f370e0637103556a81b913e3470b6534914e89bc8b898d815172a96e057f58f9e1b9b8f713a08

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52779.exe

Filesize
468KB

MD5
30b1c0af47d9b96a6674a597f64c008d

SHA1
06923210bafe2530e0678ca04a241f5085e0668f

SHA256
40bbb313d6d394ed42af11dabbc577823001a026df0f2cfd3bbae3bc220bfe33

SHA512
fa248ea5926520fdcbf5bea79cf099315806d3f74c18977a77b50454da338821e3848053c345dfc35b5f9231074ee1ce14e78be595357fee612be47b8ee1bdc6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53708.exe

Filesize
468KB

MD5
a75e538d52be24e0fd4281468124cd03

SHA1
e6a7270cfd576842283d12da359b3d0603685aa5

SHA256
5a5ff1329cb99481128e3de3dafdc20a0136baa04e4495e429207acb7464b432

SHA512
b072a064a73157403f3867dbc128abe56845fe2799e78531d66df1b7dca04cd6d5a8acfad8d0cb420dae335282a53358999fe817cdec4e0954b4b8b50652f8be

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55244.exe

Filesize
468KB

MD5
317d88b79e38e0b905816b4416994fdc

SHA1
6401d719a0ad5f08b39905f115768cc39c17abcc

SHA256
66888f9d6c173872cc0e0cd6bb82ee512041afb3a4ad37fc6d3997129b7cca37

SHA512
1ecf71f49437d3a3e74f349e9ee410eb1aef341314f48565378153ced2dadc39872c77bece5c5ef5211b1c44a7dd11beb85821454953b7f256a41d08f6c4a0ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56116.exe

Filesize
468KB

MD5
49657dd81c1d5f8f1e12d6668df667e6

SHA1
f4bceceeff0d03852c9fcc518781212e422f6042

SHA256
b2ca640af308152c36171d3509fca9aa4a871be127965f39b9c6fe731bd889bc

SHA512
f04ddc568e84231d9e78b1125f05e778c30c5a1cad8b7270d255a1dd90eff45072250ca563bae9eac1471fa35aa90ea0febe460847b82c547090571e918d897c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56308.exe

Filesize
468KB

MD5
d5f35f8827e35591141287b7c09ceaf9

SHA1
edac7f687ec41d86d267a0f8693c7052a2ef709e

SHA256
3f3ebee814b127f5b26863a777d77ad027d08b18288595af4a751e6403dac8cf

SHA512
b883ce986cf1a2574f91f7caa8a57d47502efb7d8aea226fe11a609acaec6ad33ff948322c981c6485fadf1b8c8f7ca69a2147fb53421ab8980d420da72f05b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5851.exe

Filesize
468KB

MD5
ab29f0299dcc5d3b1204d5229be53a17

SHA1
c4f658ce19d6fd307446e53c798a2bae1478ef99

SHA256
a052b137412d54e6c5cf7cc659a4399406a5250e77e80c4025f62fd733d1aa66

SHA512
2bb2cf97e254a8359ca5bc2c0d9294f59b8503bd7314901d35092b0cfd6f37cd76c67208c21a75d8f7cb9aff910261df5d7466d227c9445205a2396e7cfdff97

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6842.exe

Filesize
468KB

MD5
ed8bde18b70ddf4d5371ea5694f5f7a9

SHA1
08871125a1d88e413fc1903b52f1b37328d5ebdf

SHA256
b1ec552dad6b7f1e52c488cefebd56a59229bf8f73642052c3ae297fd9a9e82f

SHA512
e9e97d36b1379457a3d5054f0714f024cdc107f79b37fae6ffd425a606e61e172a4eb151dfe12548b84b2ecceeb00b40541aa2c772fb07494531db7e7934d7e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7299.exe

Filesize
468KB

MD5
fc2c7942742b66469a35c2bd5f80b5c2

SHA1
ae8bf3fe80f492e08a4298c4436bc90ed104f553

SHA256
20491f15b17166010c0d366ff92707281948ffc9e81167d97e0feba351569a09

SHA512
998e1f9af098438df3c59bf6b725bcad2185d3c80cc9bc0eb3a7e4876648b56a40076cbeea3e3b40b76befe9f2ea16a363706490cc4d366482194b9f546819a1

Download Submit
memory/212-498-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/376-131-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/396-439-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/432-367-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/748-327-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/844-446-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/936-176-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/976-285-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1272-500-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1380-442-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1544-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1584-265-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1636-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1656-189-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1668-416-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1780-230-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1860-413-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1896-85-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1948-348-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1972-338-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2136-50-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2144-373-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2212-303-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2216-374-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2388-190-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2392-191-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2404-145-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2500-63-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2520-278-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2548-76-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2556-123-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2600-19-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2648-48-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2692-322-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2708-256-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2752-441-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2772-370-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2780-345-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2784-117-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2808-30-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2944-412-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3028-103-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3084-55-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3120-302-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3136-414-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3180-187-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3228-363-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3236-326-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3324-364-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3380-250-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3480-304-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3500-499-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3572-192-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3616-337-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3652-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3660-405-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3696-449-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3820-184-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3912-305-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3956-188-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3984-32-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4012-415-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4036-240-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4052-282-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4080-83-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4084-111-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4100-440-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4176-222-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4256-497-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4308-210-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4332-245-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4340-447-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4344-501-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4424-351-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4452-541-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4508-77-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4520-307-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4604-86-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4696-218-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4760-366-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4764-505-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4768-404-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4828-365-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4892-235-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4896-403-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4908-502-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4944-504-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5020-264-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5044-411-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5088-153-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5144-507-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5164-508-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5184-509-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5208-510-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5216-511-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5320-521-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15564-2647-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15764-2645-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads