58cf9553f22fcc1ddb2e2c8c1269e0e2ce3b7e69232d460132eb4ed9e7a4fe42

Analysis

max time kernel
120s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01-10-2024 16:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

58cf9553f22fcc1ddb2e2c8c1269e0e2ce3b7e69232d460132eb4ed9e7a4fe42N.exe
Size

468KB
MD5

278f73ff26b17b3a626c816c4c973510
SHA1

8ca0cd19f8dfeee63d3b15d81dcb269b66352d82
SHA256

58cf9553f22fcc1ddb2e2c8c1269e0e2ce3b7e69232d460132eb4ed9e7a4fe42
SHA512

68c39b619a741faa6f914630a0bfc576344eaae9c9d4450b194703cbef2c5520cabbda1afaca0b9ee0901b9e40013352776a536497a6948d0a0afded3f8f9a5d
SSDEEP

3072:abXfog5+Pb8UwaYAPzijTf//ECh6Z4pfhdHeZVrUs3WNyrITkayL:abPohYUwIPejTfQEq0s3q0ITk

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1004	Unicorn-34300.exe
1928	Unicorn-32520.exe
3624	Unicorn-16930.exe
1164	Unicorn-22728.exe
3064	Unicorn-11990.exe
644	Unicorn-40024.exe
3288	Unicorn-29809.exe
2308	Unicorn-22100.exe
592	Unicorn-9826.exe
1992	Unicorn-37860.exe
3204	Unicorn-52150.exe
3296	Unicorn-58280.exe
1840	Unicorn-42690.exe
1360	Unicorn-13355.exe
3408	Unicorn-25343.exe
4088	Unicorn-16968.exe
4076	Unicorn-610.exe
756	Unicorn-32728.exe
2928	Unicorn-28644.exe
3540	Unicorn-49811.exe
4440	Unicorn-4139.exe
4248	Unicorn-63546.exe
3124	Unicorn-63546.exe
1192	Unicorn-62063.exe
4492	Unicorn-32920.exe
2888	Unicorn-32920.exe
2440	Unicorn-41088.exe
1604	Unicorn-4139.exe
392	Unicorn-32157.exe
516	Unicorn-36739.exe
2940	Unicorn-37750.exe
4724	Unicorn-28016.exe
4344	Unicorn-32846.exe
4512	Unicorn-56988.exe
1984	Unicorn-64580.exe
1204	Unicorn-64580.exe
4136	Unicorn-13333.exe
3768	Unicorn-60688.exe
4868	Unicorn-28784.exe
4960	Unicorn-48939.exe
4620	Unicorn-2233.exe
1436	Unicorn-13194.exe
3500	Unicorn-21362.exe
2504	Unicorn-61840.exe
404	Unicorn-4471.exe
1212	Unicorn-20808.exe
4116	Unicorn-15186.exe
5096	Unicorn-40652.exe
2644	Unicorn-20786.exe
2832	Unicorn-52904.exe
368	Unicorn-41398.exe
1420	Unicorn-3895.exe
2672	Unicorn-3895.exe
3236	Unicorn-3895.exe
2032	Unicorn-56418.exe
3728	Unicorn-45483.exe
232	Unicorn-366.exe
3992	Unicorn-14101.exe
3348	Unicorn-15882.exe
4060	Unicorn-10017.exe
4988	Unicorn-10454.exe
3572	Unicorn-1731.exe
4804	Unicorn-55571.exe
4504	Unicorn-48886.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36096.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56753.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1643.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46236.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29059.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43984.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2864.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46568.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41526.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52364.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11482.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37727.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23424.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63379.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50112.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26696.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30505.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17307.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46184.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12523.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9697.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51960.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52243.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10722.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53215.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54700.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32154.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48088.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26008.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43984.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32154.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42042.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10847.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46804.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54284.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57403.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26008.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16578.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43090.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24899.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39936.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44731.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3895.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40652.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19249.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37152.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7891.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40786.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32154.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47078.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53488.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13355.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2759.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52767.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20889.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54596.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53468.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34834.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36622.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59056.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11106.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31526.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8558.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18763.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	1272	dwm.exe
Token: SeChangeNotifyPrivilege	1272	dwm.exe
Token: 33	1272	dwm.exe
Token: SeIncBasePriorityPrivilege	1272	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4468	58cf9553f22fcc1ddb2e2c8c1269e0e2ce3b7e69232d460132eb4ed9e7a4fe42N.exe
1004	Unicorn-34300.exe
1928	Unicorn-32520.exe
3624	Unicorn-16930.exe
1164	Unicorn-22728.exe
3064	Unicorn-11990.exe
3288	Unicorn-29809.exe
644	Unicorn-40024.exe
2308	Unicorn-22100.exe
592	Unicorn-9826.exe
3296	Unicorn-58280.exe
1992	Unicorn-37860.exe
1840	Unicorn-42690.exe
3204	Unicorn-52150.exe
1360	Unicorn-13355.exe
3408	Unicorn-25343.exe
4088	Unicorn-16968.exe
756	Unicorn-32728.exe
4076	Unicorn-610.exe
3540	Unicorn-49811.exe
3124	Unicorn-63546.exe
4492	Unicorn-32920.exe
2928	Unicorn-28644.exe
4440	Unicorn-4139.exe
4248	Unicorn-63546.exe
1192	Unicorn-62063.exe
2940	Unicorn-37750.exe
2888	Unicorn-32920.exe
516	Unicorn-36739.exe
2440	Unicorn-41088.exe
392	Unicorn-32157.exe
1604	Unicorn-4139.exe
4724	Unicorn-28016.exe
4344	Unicorn-32846.exe
4512	Unicorn-56988.exe
1984	Unicorn-64580.exe
4136	Unicorn-13333.exe
1204	Unicorn-64580.exe
3768	Unicorn-60688.exe
4868	Unicorn-28784.exe
4960	Unicorn-48939.exe
4620	Unicorn-2233.exe
1436	Unicorn-13194.exe
2504	Unicorn-61840.exe
3500	Unicorn-21362.exe
404	Unicorn-4471.exe
1212	Unicorn-20808.exe
2832	Unicorn-52904.exe
1420	Unicorn-3895.exe
4060	Unicorn-10017.exe
2644	Unicorn-20786.exe
4116	Unicorn-15186.exe
368	Unicorn-41398.exe
2672	Unicorn-3895.exe
2032	Unicorn-56418.exe
3728	Unicorn-45483.exe
232	Unicorn-366.exe
3992	Unicorn-14101.exe
5096	Unicorn-40652.exe
3348	Unicorn-15882.exe
3236	Unicorn-3895.exe
4504	Unicorn-48886.exe
4580	Unicorn-58716.exe
4804	Unicorn-55571.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4468 wrote to memory of 1004	4468	58cf9553f22fcc1ddb2e2c8c1269e0e2ce3b7e69232d460132eb4ed9e7a4fe42N.exe	82
PID 4468 wrote to memory of 1004	4468	58cf9553f22fcc1ddb2e2c8c1269e0e2ce3b7e69232d460132eb4ed9e7a4fe42N.exe	82
PID 4468 wrote to memory of 1004	4468	58cf9553f22fcc1ddb2e2c8c1269e0e2ce3b7e69232d460132eb4ed9e7a4fe42N.exe	82
PID 1004 wrote to memory of 1928	1004	Unicorn-34300.exe	83
PID 1004 wrote to memory of 1928	1004	Unicorn-34300.exe	83
PID 1004 wrote to memory of 1928	1004	Unicorn-34300.exe	83
PID 4468 wrote to memory of 3624	4468	58cf9553f22fcc1ddb2e2c8c1269e0e2ce3b7e69232d460132eb4ed9e7a4fe42N.exe	84
PID 4468 wrote to memory of 3624	4468	58cf9553f22fcc1ddb2e2c8c1269e0e2ce3b7e69232d460132eb4ed9e7a4fe42N.exe	84
PID 4468 wrote to memory of 3624	4468	58cf9553f22fcc1ddb2e2c8c1269e0e2ce3b7e69232d460132eb4ed9e7a4fe42N.exe	84
PID 1928 wrote to memory of 1164	1928	Unicorn-32520.exe	89
PID 1928 wrote to memory of 1164	1928	Unicorn-32520.exe	89
PID 1928 wrote to memory of 1164	1928	Unicorn-32520.exe	89
PID 1004 wrote to memory of 3064	1004	Unicorn-34300.exe	90
PID 1004 wrote to memory of 3064	1004	Unicorn-34300.exe	90
PID 1004 wrote to memory of 3064	1004	Unicorn-34300.exe	90
PID 3624 wrote to memory of 644	3624	Unicorn-16930.exe	91
PID 3624 wrote to memory of 644	3624	Unicorn-16930.exe	91
PID 3624 wrote to memory of 644	3624	Unicorn-16930.exe	91
PID 4468 wrote to memory of 3288	4468	58cf9553f22fcc1ddb2e2c8c1269e0e2ce3b7e69232d460132eb4ed9e7a4fe42N.exe	92
PID 4468 wrote to memory of 3288	4468	58cf9553f22fcc1ddb2e2c8c1269e0e2ce3b7e69232d460132eb4ed9e7a4fe42N.exe	92
PID 4468 wrote to memory of 3288	4468	58cf9553f22fcc1ddb2e2c8c1269e0e2ce3b7e69232d460132eb4ed9e7a4fe42N.exe	92
PID 1164 wrote to memory of 2308	1164	Unicorn-22728.exe	94
PID 1164 wrote to memory of 2308	1164	Unicorn-22728.exe	94
PID 1164 wrote to memory of 2308	1164	Unicorn-22728.exe	94
PID 1928 wrote to memory of 592	1928	Unicorn-32520.exe	95
PID 1928 wrote to memory of 592	1928	Unicorn-32520.exe	95
PID 1928 wrote to memory of 592	1928	Unicorn-32520.exe	95
PID 3064 wrote to memory of 1992	3064	Unicorn-11990.exe	96
PID 3064 wrote to memory of 1992	3064	Unicorn-11990.exe	96
PID 3064 wrote to memory of 1992	3064	Unicorn-11990.exe	96
PID 1004 wrote to memory of 3204	1004	Unicorn-34300.exe	97
PID 1004 wrote to memory of 3204	1004	Unicorn-34300.exe	97
PID 1004 wrote to memory of 3204	1004	Unicorn-34300.exe	97
PID 644 wrote to memory of 3296	644	Unicorn-40024.exe	98
PID 644 wrote to memory of 3296	644	Unicorn-40024.exe	98
PID 644 wrote to memory of 3296	644	Unicorn-40024.exe	98
PID 3624 wrote to memory of 1840	3624	Unicorn-16930.exe	99
PID 3624 wrote to memory of 1840	3624	Unicorn-16930.exe	99
PID 3624 wrote to memory of 1840	3624	Unicorn-16930.exe	99
PID 3288 wrote to memory of 1360	3288	Unicorn-29809.exe	100
PID 3288 wrote to memory of 1360	3288	Unicorn-29809.exe	100
PID 3288 wrote to memory of 1360	3288	Unicorn-29809.exe	100
PID 4468 wrote to memory of 3408	4468	58cf9553f22fcc1ddb2e2c8c1269e0e2ce3b7e69232d460132eb4ed9e7a4fe42N.exe	101
PID 4468 wrote to memory of 3408	4468	58cf9553f22fcc1ddb2e2c8c1269e0e2ce3b7e69232d460132eb4ed9e7a4fe42N.exe	101
PID 4468 wrote to memory of 3408	4468	58cf9553f22fcc1ddb2e2c8c1269e0e2ce3b7e69232d460132eb4ed9e7a4fe42N.exe	101
PID 2308 wrote to memory of 4088	2308	Unicorn-22100.exe	104
PID 2308 wrote to memory of 4088	2308	Unicorn-22100.exe	104
PID 2308 wrote to memory of 4088	2308	Unicorn-22100.exe	104
PID 1164 wrote to memory of 4076	1164	Unicorn-22728.exe	105
PID 1164 wrote to memory of 4076	1164	Unicorn-22728.exe	105
PID 1164 wrote to memory of 4076	1164	Unicorn-22728.exe	105
PID 3296 wrote to memory of 756	3296	Unicorn-58280.exe	106
PID 3296 wrote to memory of 756	3296	Unicorn-58280.exe	106
PID 3296 wrote to memory of 756	3296	Unicorn-58280.exe	106
PID 592 wrote to memory of 2928	592	Unicorn-9826.exe	107
PID 592 wrote to memory of 2928	592	Unicorn-9826.exe	107
PID 592 wrote to memory of 2928	592	Unicorn-9826.exe	107
PID 644 wrote to memory of 3540	644	Unicorn-40024.exe	108
PID 644 wrote to memory of 3540	644	Unicorn-40024.exe	108
PID 644 wrote to memory of 3540	644	Unicorn-40024.exe	108
PID 3624 wrote to memory of 4248	3624	Unicorn-16930.exe	110
PID 3624 wrote to memory of 4248	3624	Unicorn-16930.exe	110
PID 3624 wrote to memory of 4248	3624	Unicorn-16930.exe	110
PID 1928 wrote to memory of 3124	1928	Unicorn-32520.exe	111

C:\Users\Admin\AppData\Local\Temp\58cf9553f22fcc1ddb2e2c8c1269e0e2ce3b7e69232d460132eb4ed9e7a4fe42N.exe
"C:\Users\Admin\AppData\Local\Temp\58cf9553f22fcc1ddb2e2c8c1269e0e2ce3b7e69232d460132eb4ed9e7a4fe42N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4468
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34300.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34300.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32520.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32520.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22728.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22728.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22100.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16968.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28016.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1731.exe
        8⤵
        Executes dropped EXE
        
        PID:3572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1643.exe
        9⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3195.exe
        10⤵
        
        PID:7632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63379.exe
        10⤵
        
        PID:10288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37727.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:10516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28830.exe
        9⤵
        
        PID:6280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45558.exe
        9⤵
        
        PID:11624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52447.exe
        9⤵
        
        PID:2052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33636.exe
        9⤵
        
        PID:11232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65239.exe
        8⤵
        
        PID:6300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8771.exe
        9⤵
        
        PID:10388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49939.exe
        9⤵
        
        PID:15324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34188.exe
        9⤵
        
        PID:16428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23385.exe
        8⤵
        
        PID:10248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50203.exe
        8⤵
        
        PID:14092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62954.exe
        8⤵
        
        PID:10872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55571.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1643.exe
        8⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17840.exe
        9⤵
        
        PID:7272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57780.exe
        10⤵
        
        PID:10588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38646.exe
        10⤵
        
        PID:14032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14131.exe
        10⤵
        
        PID:6988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8558.exe
        9⤵
        
        PID:11176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57670.exe
        9⤵
        
        PID:14548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25973.exe
        9⤵
        
        PID:10300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50.exe
        8⤵
        
        PID:7200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33305.exe
        8⤵
        
        PID:12164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41236.exe
        8⤵
        
        PID:16664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1517.exe
        7⤵
        
        PID:6640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30196.exe
        8⤵
        
        PID:8688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49887.exe
        8⤵
        
        PID:11044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54863.exe
        8⤵
        
        PID:7028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58261.exe
        8⤵
        
        PID:10696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55587.exe
        7⤵
        
        PID:8412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29540.exe
        8⤵
        
        PID:15020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41236.exe
        8⤵
        
        PID:5332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43090.exe
        7⤵
        
        PID:11992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58169.exe
        7⤵
        
        PID:16120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32846.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58716.exe
        7⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20912.exe
        8⤵
        
        PID:5508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21710.exe
        9⤵
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1615.exe
        10⤵
        
        PID:7384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17126.exe
        10⤵
        
        PID:13288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50888.exe
        10⤵
        
        PID:4104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5552.exe
        10⤵
        
        PID:7740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33969.exe
        9⤵
        
        PID:10756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6742.exe
        9⤵
        
        PID:14400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35472.exe
        9⤵
        
        PID:14988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25986.exe
        8⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57884.exe
        9⤵
        
        PID:12832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20107.exe
        9⤵
        
        PID:16400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46223.exe
        8⤵
        
        PID:9660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27468.exe
        8⤵
        
        PID:2796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22810.exe
        7⤵
        
        PID:5252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26008.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10847.exe
        9⤵
        
        PID:11708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61661.exe
        9⤵
        
        PID:16488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51755.exe
        8⤵
        
        PID:12412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28819.exe
        8⤵
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49780.exe
        8⤵
        
        PID:10444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1725.exe
        7⤵
        
        PID:4480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10582.exe
        7⤵
        
        PID:11728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57401.exe
        7⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42918.exe
        7⤵
        
        PID:10988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7469.exe
        6⤵
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57668.exe
        7⤵
        
        PID:5412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41768.exe
        8⤵
        
        PID:6376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4879.exe
        9⤵
        
        PID:10752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65315.exe
        9⤵
        
        PID:15132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62777.exe
        9⤵
        
        PID:16900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12450.exe
        8⤵
        
        PID:10272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4001.exe
        8⤵
        
        PID:13888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3852.exe
        8⤵
        
        PID:3676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61656.exe
        8⤵
        
        PID:10832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28638.exe
        7⤵
        
        PID:7780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4687.exe
        8⤵
        
        PID:8248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45855.exe
        8⤵
        
        PID:15300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21012.exe
        8⤵
        
        PID:1796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11577.exe
        7⤵
        
        PID:9356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48088.exe
        7⤵
        
        PID:520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6806.exe
        6⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46236.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53696.exe
        8⤵
        
        PID:8504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29518.exe
        8⤵
        
        PID:14004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64456.exe
        8⤵
        
        PID:11208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28489.exe
        7⤵
        
        PID:11076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61371.exe
        7⤵
        
        PID:15224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13936.exe
        7⤵
        
        PID:16500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35489.exe
        6⤵
        
        PID:7796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57779.exe
        6⤵
        
        PID:10612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19879.exe
        6⤵
        
        PID:5272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40172.exe
        6⤵
        
        PID:11364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-610.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56988.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1347.exe
        7⤵
        
        PID:1836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13895.exe
        8⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56672.exe
        9⤵
        
        PID:7892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63379.exe
        9⤵
        
        PID:11040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52669.exe
        9⤵
        
        PID:632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39072.exe
        9⤵
        
        PID:12344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16578.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33305.exe
        8⤵
        
        PID:11664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40003.exe
        8⤵
        
        PID:15376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42380.exe
        8⤵
        
        PID:11376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53319.exe
        7⤵
        
        PID:6648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23424.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11283.exe
        9⤵
        
        PID:15200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19337.exe
        9⤵
        
        PID:16340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52243.exe
        8⤵
        
        PID:11484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60837.exe
        8⤵
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3261.exe
        7⤵
        
        PID:8728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3950.exe
        7⤵
        
        PID:4796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54284.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10262.exe
        6⤵
        
        PID:208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1643.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26008.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8558.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57670.exe
        8⤵
        
        PID:14556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60474.exe
        8⤵
        
        PID:16864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61695.exe
        7⤵
        
        PID:7248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12885.exe
        7⤵
        
        PID:11744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12483.exe
        7⤵
        
        PID:2168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36952.exe
        7⤵
        
        PID:10796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62935.exe
        6⤵
        
        PID:6244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46540.exe
        7⤵
        
        PID:9680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33654.exe
        7⤵
        
        PID:14324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59056.exe
        7⤵
        
        PID:5612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52794.exe
        6⤵
        
        PID:9572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55143.exe
        6⤵
        
        PID:13080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43787.exe
        6⤵
        
        PID:16412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13333.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55940.exe
        6⤵
        
        PID:2912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46952.exe
        7⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43984.exe
        8⤵
        
        PID:8240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32154.exe
        8⤵
        
        PID:11896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50888.exe
        8⤵
        
        PID:1848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42042.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16748.exe
        8⤵
        
        PID:10964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15912.exe
        8⤵
        
        PID:780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47240.exe
        8⤵
        
        PID:372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62086.exe
        7⤵
        
        PID:11688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5576.exe
        7⤵
        
        PID:16324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17102.exe
        6⤵
        
        PID:6844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23372.exe
        7⤵
        
        PID:9208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7650.exe
        7⤵
        
        PID:13280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23807.exe
        7⤵
        
        PID:11212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49722.exe
        6⤵
        
        PID:8332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51755.exe
        6⤵
        
        PID:11468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54284.exe
        6⤵
        
        PID:16204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51975.exe
        5⤵
        
        PID:4852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39936.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29820.exe
        7⤵
        
        PID:9752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28838.exe
        7⤵
        
        PID:13300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48312.exe
        7⤵
        
        PID:8836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63423.exe
        6⤵
        
        PID:8416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58194.exe
        6⤵
        
        PID:1048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27096.exe
        6⤵
        
        PID:1792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15785.exe
        5⤵
        
        PID:6820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54700.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41526.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50888.exe
        6⤵
        
        PID:2632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1660.exe
        6⤵
        
        PID:8792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30386.exe
        5⤵
        
        PID:8348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43620.exe
        5⤵
        
        PID:11520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4503.exe
        5⤵
        
        PID:16004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9826.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9826.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28644.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61840.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44264.exe
        7⤵
        
        PID:4180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8031.exe
        8⤵
        
        PID:6508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29554.exe
        9⤵
        
        PID:10920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16637.exe
        9⤵
        
        PID:14372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57988.exe
        9⤵
        
        PID:16068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52707.exe
        8⤵
        
        PID:9176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21385.exe
        8⤵
        
        PID:11724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55137.exe
        8⤵
        
        PID:7432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6770.exe
        7⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43984.exe
        8⤵
        
        PID:4944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32154.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37157.exe
        8⤵
        
        PID:4224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2309.exe
        7⤵
        
        PID:9636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14806.exe
        7⤵
        
        PID:13176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58148.exe
        7⤵
        
        PID:4020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-854.exe
        6⤵
        
        PID:5336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27020.exe
        7⤵
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10167.exe
        8⤵
        
        PID:8704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45802.exe
        8⤵
        
        PID:12864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29673.exe
        8⤵
        
        PID:10676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31526.exe
        7⤵
        
        PID:10172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12169.exe
        7⤵
        
        PID:13508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57988.exe
        7⤵
        
        PID:16056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23193.exe
        6⤵
        
        PID:6564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23572.exe
        7⤵
        
        PID:10744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52679.exe
        7⤵
        
        PID:14740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38273.exe
        7⤵
        
        PID:6176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35751.exe
        6⤵
        
        PID:10568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63614.exe
        6⤵
        
        PID:13640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11324.exe
        6⤵
        
        PID:1488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20786.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55867.exe
        6⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43984.exe
        7⤵
        
        PID:8228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32154.exe
        7⤵
        
        PID:916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25096.exe
        7⤵
        
        PID:5584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59670.exe
        6⤵
        
        PID:7508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15434.exe
        6⤵
        
        PID:12068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10769.exe
        6⤵
        
        PID:3840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23525.exe
        5⤵
        
        PID:5768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26008.exe
        6⤵
        
        PID:7324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54443.exe
        6⤵
        
        PID:6256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13513.exe
        6⤵
        
        PID:15140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5580.exe
        6⤵
        
        PID:15744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25667.exe
        6⤵
        
        PID:12032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11482.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30505.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59391.exe
        5⤵
        
        PID:16472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63546.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63546.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64580.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33718.exe
        6⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18764.exe
        7⤵
        
        PID:7392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51755.exe
        7⤵
        
        PID:12056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49323.exe
        7⤵
        
        PID:16076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62410.exe
        6⤵
        
        PID:7928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17442.exe
        6⤵
        
        PID:10384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40838.exe
        6⤵
        
        PID:14184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34759.exe
        6⤵
        
        PID:5932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32374.exe
        5⤵
        
        PID:400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36620.exe
        6⤵
        
        PID:6556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23372.exe
        7⤵
        
        PID:3896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7650.exe
        7⤵
        
        PID:12492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28275.exe
        7⤵
        
        PID:10484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44731.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45890.exe
        6⤵
        
        PID:11444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6265.exe
        6⤵
        
        PID:5164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20505.exe
        5⤵
        
        PID:5156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26696.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17510.exe
        6⤵
        
        PID:14120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59056.exe
        6⤵
        
        PID:4700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8174.exe
        5⤵
        
        PID:9620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6141.exe
        5⤵
        
        PID:13192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37748.exe
        5⤵
        
        PID:16168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5585.exe
        5⤵
        
        PID:11136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48939.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48939.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36096.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7071.exe
        6⤵
        
        PID:5664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64456.exe
        7⤵
        
        PID:8036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7318.exe
        7⤵
        
        PID:11512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49436.exe
        7⤵
        
        PID:15756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5055.exe
        7⤵
        
        PID:10632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42042.exe
        6⤵
        
        PID:8404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58194.exe
        6⤵
        
        PID:12284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15912.exe
        6⤵
        
        PID:6708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20889.exe
        5⤵
        
        PID:6100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52352.exe
        6⤵
        
        PID:10716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52679.exe
        6⤵
        
        PID:14752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23115.exe
        5⤵
        
        PID:6040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61502.exe
        5⤵
        
        PID:13772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14853.exe
        5⤵
        
        PID:5436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12173.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12173.exe
      4⤵
      PID:4520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54264.exe
        5⤵
        
        PID:6172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43984.exe
        6⤵
        
        PID:4528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32154.exe
        6⤵
        
        PID:11772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33072.exe
        6⤵
        
        PID:16380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54111.exe
        5⤵
        
        PID:9628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8941.exe
        5⤵
        
        PID:13060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6265.exe
        5⤵
        
        PID:3068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22934.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22934.exe
      4⤵
      PID:6968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63644.exe
        5⤵
        
        PID:9064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38122.exe
        5⤵
        
        PID:14160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46804.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42992.exe
      4⤵
      PID:9956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20273.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20273.exe
      4⤵
      PID:13564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60785.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60785.exe
      4⤵
      PID:12568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11990.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11990.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37860.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37860.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41088.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20808.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7699.exe
        7⤵
        
        PID:3168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-979.exe
        8⤵
        
        PID:1640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43984.exe
        9⤵
        
        PID:7884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32154.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:11616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65252.exe
        9⤵
        
        PID:15780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22080.exe
        9⤵
        
        PID:11836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29606.exe
        8⤵
        
        PID:9196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4857.exe
        8⤵
        
        PID:12400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51922.exe
        8⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40786.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12523.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60743.exe
        8⤵
        
        PID:3264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53685.exe
        8⤵
        
        PID:6292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8506.exe
        7⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34759.exe
        7⤵
        
        PID:5924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14066.exe
        6⤵
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51628.exe
        7⤵
        
        PID:7424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21770.exe
        7⤵
        
        PID:10764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63674.exe
        7⤵
        
        PID:13320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25973.exe
        7⤵
        
        PID:10492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43718.exe
        6⤵
        
        PID:7564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45321.exe
        7⤵
        
        PID:5604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6114.exe
        6⤵
        
        PID:11900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21905.exe
        6⤵
        
        PID:2528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41398.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34124.exe
        6⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28364.exe
        7⤵
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41880.exe
        8⤵
        
        PID:10032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36622.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25096.exe
        8⤵
        
        PID:16624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20426.exe
        7⤵
        
        PID:9312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32781.exe
        7⤵
        
        PID:14204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24164.exe
        7⤵
        
        PID:5160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61656.exe
        7⤵
        
        PID:10876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10766.exe
        6⤵
        
        PID:7464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35506.exe
        6⤵
        
        PID:10372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4002.exe
        6⤵
        
        PID:15288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50693.exe
        6⤵
        
        PID:16876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4065.exe
        5⤵
        
        PID:5524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44228.exe
        6⤵
        
        PID:7716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63379.exe
        6⤵
        
        PID:10532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43638.exe
        6⤵
        
        PID:14180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15912.exe
        6⤵
        
        PID:5844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65535.exe
        5⤵
        
        PID:8136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6769.exe
        5⤵
        
        PID:12076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28966.exe
        5⤵
        
        PID:5264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26239.exe
        5⤵
        
        PID:12536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37750.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37750.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64580.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22500.exe
        6⤵
        
        PID:1752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62712.exe
        7⤵
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27020.exe
        8⤵
        
        PID:6468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22420.exe
        9⤵
        
        PID:8908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13234.exe
        9⤵
        
        PID:13904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42803.exe
        9⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62153.exe
        9⤵
        
        PID:8212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19274.exe
        8⤵
        
        PID:9984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60218.exe
        8⤵
        
        PID:13392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17307.exe
        8⤵
        
        PID:10488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9458.exe
        7⤵
        
        PID:7024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-411.exe
        8⤵
        
        PID:10952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2902.exe
        8⤵
        
        PID:14392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16215.exe
        8⤵
        
        PID:12532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29885.exe
        7⤵
        
        PID:10596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51667.exe
        7⤵
        
        PID:13040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43257.exe
        7⤵
        
        PID:11524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41066.exe
        6⤵
        
        PID:6604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23372.exe
        7⤵
        
        PID:7172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7650.exe
        7⤵
        
        PID:12276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65032.exe
        7⤵
        
        PID:2728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49722.exe
        6⤵
        
        PID:8568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51755.exe
        6⤵
        
        PID:1832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49323.exe
        6⤵
        
        PID:16176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48414.exe
        5⤵
        
        PID:6020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40336.exe
        6⤵
        
        PID:7848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63379.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61656.exe
        6⤵
        
        PID:10880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49583.exe
        5⤵
        
        PID:7416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20832.exe
        6⤵
        
        PID:10996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52669.exe
        6⤵
        
        PID:1768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59286.exe
        5⤵
        
        PID:11680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6106.exe
        5⤵
        
        PID:16348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2233.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2233.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23844.exe
        5⤵
        
        PID:1868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7071.exe
        6⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52588.exe
        7⤵
        
        PID:7832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63379.exe
        7⤵
        
        PID:9332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60152.exe
        7⤵
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45512.exe
        7⤵
        
        PID:11132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5050.exe
        6⤵
        
        PID:9824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7101.exe
        6⤵
        
        PID:13416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26721.exe
        6⤵
        
        PID:3060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20889.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-411.exe
        6⤵
        
        PID:10976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43935.exe
        6⤵
        
        PID:14564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4484.exe
        6⤵
        
        PID:15396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34791.exe
        5⤵
        
        PID:6012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61502.exe
        5⤵
        
        PID:13348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14853.exe
        5⤵
        
        PID:16588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20838.exe
      4⤵
      PID:4668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47632.exe
        5⤵
        
        PID:6584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9207.exe
        6⤵
        
        PID:10132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45175.exe
        6⤵
        
        PID:13724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34188.exe
        6⤵
        
        PID:16448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11106.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14506.exe
        6⤵
        
        PID:16268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64302.exe
        5⤵
        
        PID:13304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48222.exe
        5⤵
        
        PID:16440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28561.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28561.exe
      4⤵
      PID:5460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22420.exe
        5⤵
        
        PID:8068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45802.exe
        5⤵
        
        PID:13056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44138.exe
        5⤵
        
        PID:11816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10550.exe
      4⤵
      PID:10536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64144.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64144.exe
      4⤵
      PID:13540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41423.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41423.exe
      4⤵
      PID:7400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52150.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52150.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32920.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32920.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52904.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65260.exe
        6⤵
        
        PID:4964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55800.exe
        7⤵
        
        PID:6548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19096.exe
        8⤵
        
        PID:8708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32154.exe
        8⤵
        
        PID:11908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38273.exe
        8⤵
        
        PID:7132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42818.exe
        7⤵
        
        PID:9792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36466.exe
        7⤵
        
        PID:10784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61371.exe
        7⤵
        
        PID:13588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21007.exe
        7⤵
        
        PID:11224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30070.exe
        6⤵
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34916.exe
        7⤵
        
        PID:13184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52202.exe
        7⤵
        
        PID:5748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33971.exe
        6⤵
        
        PID:11184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43996.exe
        6⤵
        
        PID:3472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59062.exe
        6⤵
        
        PID:11092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17085.exe
        5⤵
        
        PID:6164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56672.exe
        6⤵
        
        PID:7876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63379.exe
        6⤵
        
        PID:11288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15912.exe
        6⤵
        
        PID:4652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21583.exe
        6⤵
        
        PID:11948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9126.exe
        5⤵
        
        PID:8716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60822.exe
        5⤵
        
        PID:11204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27468.exe
        5⤵
        
        PID:1596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22113.exe
        5⤵
        
        PID:12180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45483.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45483.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7891.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46096.exe
        6⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-411.exe
        7⤵
        
        PID:10944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2902.exe
        7⤵
        
        PID:14384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64648.exe
        7⤵
        
        PID:11016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45262.exe
        6⤵
        
        PID:10120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18034.exe
        6⤵
        
        PID:13788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-203.exe
        6⤵
        
        PID:10244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44574.exe
        5⤵
        
        PID:7312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53364.exe
        6⤵
        
        PID:9560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60743.exe
        6⤵
        
        PID:13108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28275.exe
        6⤵
        
        PID:10332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47235.exe
        5⤵
        
        PID:9116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1201.exe
        5⤵
        
        PID:13900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34157.exe
        5⤵
        
        PID:16524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22757.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22757.exe
      4⤵
      PID:5352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27020.exe
        5⤵
        
        PID:6532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8771.exe
        6⤵
        
        PID:10528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17266.exe
        6⤵
        
        PID:14288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19531.exe
        6⤵
        
        PID:8992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31526.exe
        5⤵
        
        PID:10092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12169.exe
        5⤵
        
        PID:13492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10349.exe
        5⤵
        
        PID:16636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49671.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49671.exe
      4⤵
      PID:4824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28978.exe
        5⤵
        
        PID:11032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57670.exe
        5⤵
        
        PID:14572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22080.exe
        5⤵
        
        PID:11368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27085.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27085.exe
      4⤵
      PID:10544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47078.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47078.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9697.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9697.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:15992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36739.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36739.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40652.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40652.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:5096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25380.exe
        5⤵
        
        PID:5216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47632.exe
        6⤵
        
        PID:6804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20832.exe
        7⤵
        
        PID:11004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3660.exe
        7⤵
        
        PID:5504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31526.exe
        6⤵
        
        PID:10048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12169.exe
        6⤵
        
        PID:13556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1276.exe
        6⤵
        
        PID:15428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38238.exe
        5⤵
        
        PID:5992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45196.exe
        6⤵
        
        PID:9600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60743.exe
        6⤵
        
        PID:13196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57084.exe
        6⤵
        
        PID:16216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41370.exe
        5⤵
        
        PID:10220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9866.exe
        5⤵
        
        PID:14028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7330.exe
        5⤵
        
        PID:6308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42188.exe
        5⤵
        
        PID:10412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22618.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22618.exe
      4⤵
      PID:5720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47632.exe
        5⤵
        
        PID:6796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57256.exe
        6⤵
        
        PID:9524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56659.exe
        6⤵
        
        PID:13168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57084.exe
        6⤵
        
        PID:16188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31526.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12169.exe
        5⤵
        
        PID:13452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40054.exe
        5⤵
        
        PID:16416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23193.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23193.exe
      4⤵
      PID:6752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63644.exe
        5⤵
        
        PID:9204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17510.exe
        5⤵
        
        PID:14112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28988.exe
        5⤵
        
        PID:2204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25305.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25305.exe
      4⤵
      PID:672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9121.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9121.exe
      4⤵
      PID:5576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26239.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26239.exe
      4⤵
      PID:12152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56418.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56418.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61176.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61176.exe
      4⤵
      PID:2772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31960.exe
        5⤵
        
        PID:6524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36060.exe
        6⤵
        
        PID:7732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63379.exe
        6⤵
        
        PID:10376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24849.exe
        6⤵
        
        PID:7048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33643.exe
        6⤵
        
        PID:16656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10138.exe
        5⤵
        
        PID:8456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45321.exe
        6⤵
        
        PID:5616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4909.exe
        5⤵
        
        PID:12140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37293.exe
        5⤵
        
        PID:2144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62424.exe
        5⤵
        
        PID:11012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50927.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50927.exe
      4⤵
      PID:6996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51384.exe
        5⤵
        
        PID:8944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54355.exe
        5⤵
        
        PID:12792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42803.exe
        5⤵
        
        PID:11800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13720.exe
        5⤵
        
        PID:9032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62166.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62166.exe
      4⤵
      PID:8712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51755.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51755.exe
      4⤵
      PID:11936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30272.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30272.exe
      4⤵
      PID:5284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17018.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17018.exe
    3⤵
    PID:5688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49080.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49080.exe
      4⤵
      PID:8060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19570.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19570.exe
      4⤵
      PID:11636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57905.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57905.exe
      4⤵
      PID:6052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49404.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49404.exe
      4⤵
      PID:10896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24343.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24343.exe
    3⤵
    PID:8140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33068.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33068.exe
      4⤵
      PID:4984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29619.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29619.exe
      4⤵
      PID:12340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9505.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9505.exe
    3⤵
    PID:11540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61422.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61422.exe
    3⤵
    PID:16560
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16930.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16930.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40024.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40024.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58280.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58280.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32728.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10454.exe
        6⤵
        Executes dropped EXE
        
        PID:4988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17404.exe
        7⤵
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33904.exe
        8⤵
        
        PID:9764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61703.exe
        8⤵
        
        PID:13436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21012.exe
        8⤵
        
        PID:16616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57419.exe
        7⤵
        
        PID:5580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29835.exe
        8⤵
        
        PID:15768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50040.exe
        8⤵
        
        PID:10476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33305.exe
        7⤵
        
        PID:11552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52364.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54802.exe
        6⤵
        
        PID:6596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5307.exe
        7⤵
        
        PID:8764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4194.exe
        7⤵
        
        PID:1428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59056.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16421.exe
        6⤵
        
        PID:9960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50548.exe
        6⤵
        
        PID:3048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33639.exe
        6⤵
        
        PID:11988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48886.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42484.exe
        6⤵
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60372.exe
        7⤵
        
        PID:8072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19570.exe
        7⤵
        
        PID:11572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35970.exe
        7⤵
        
        PID:16456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12878.exe
        6⤵
        
        PID:8160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12435.exe
        7⤵
        
        PID:13460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60178.exe
        7⤵
        
        PID:16252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33305.exe
        6⤵
        
        PID:11656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49323.exe
        6⤵
        
        PID:16196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10122.exe
        5⤵
        
        PID:1120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36060.exe
        6⤵
        
        PID:7696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53468.exe
        7⤵
        
        PID:3020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40359.exe
        7⤵
        
        PID:752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24383.exe
        7⤵
        
        PID:4176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63379.exe
        6⤵
        
        PID:11280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15912.exe
        6⤵
        
        PID:5620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40918.exe
        5⤵
        
        PID:6928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46450.exe
        5⤵
        
        PID:11916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50112.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49811.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3895.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11975.exe
        6⤵
        
        PID:3308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36236.exe
        7⤵
        
        PID:6576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43984.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32154.exe
        8⤵
        
        PID:12332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21012.exe
        8⤵
        
        PID:16572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56407.exe
        7⤵
        
        PID:8304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45890.exe
        7⤵
        
        PID:3160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3105.exe
        7⤵
        
        PID:16888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4850.exe
        6⤵
        
        PID:6816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27892.exe
        7⤵
        
        PID:7816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29192.exe
        8⤵
        
        PID:9360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45855.exe
        8⤵
        
        PID:15256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54609.exe
        8⤵
        
        PID:16840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63379.exe
        7⤵
        
        PID:10672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56753.exe
        7⤵
        
        PID:14404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48570.exe
        6⤵
        
        PID:8520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52767.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43257.exe
        6⤵
        
        PID:5864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1046.exe
        5⤵
        
        PID:5496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43652.exe
        6⤵
        
        PID:7448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21770.exe
        6⤵
        
        PID:10736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52190.exe
        6⤵
        
        PID:15280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49929.exe
        6⤵
        
        PID:5608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9523.exe
        6⤵
        
        PID:12336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37906.exe
        5⤵
        
        PID:7996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53520.exe
        6⤵
        
        PID:14332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6306.exe
        5⤵
        
        PID:11476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61485.exe
        5⤵
        
        PID:15384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39026.exe
        5⤵
        
        PID:8300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10017.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10017.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1643.exe
        5⤵
        
        PID:5812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54596.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20669.exe
        6⤵
        
        PID:11776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51487.exe
        6⤵
        
        PID:4860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25468.exe
        6⤵
        
        PID:12384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28830.exe
        5⤵
        
        PID:216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1548.exe
        6⤵
        
        PID:6152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64456.exe
        6⤵
        
        PID:10804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54494.exe
        5⤵
        
        PID:11996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5576.exe
        5⤵
        
        PID:16304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3682.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3682.exe
      4⤵
      PID:6484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13475.exe
        5⤵
        
        PID:8780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4194.exe
        5⤵
        
        PID:11532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54972.exe
        5⤵
        
        PID:4748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63642.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63642.exe
      4⤵
      PID:9156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2050.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2050.exe
      4⤵
      PID:12204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54018.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54018.exe
      4⤵
      PID:10704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42690.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42690.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4139.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4139.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3895.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65260.exe
        6⤵
        
        PID:2536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3947.exe
        7⤵
        
        PID:6472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63688.exe
        8⤵
        
        PID:7608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45321.exe
        9⤵
        
        PID:2320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59295.exe
        8⤵
        
        PID:10700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43638.exe
        8⤵
        
        PID:15352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62181.exe
        8⤵
        
        PID:376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34834.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34649.exe
        7⤵
        
        PID:12208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24899.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18062.exe
        6⤵
        
        PID:6976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48068.exe
        7⤵
        
        PID:8892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11939.exe
        8⤵
        
        PID:9076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32154.exe
        7⤵
        
        PID:4596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18763.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62166.exe
        6⤵
        
        PID:8748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51755.exe
        6⤵
        
        PID:11868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5768.exe
        6⤵
        
        PID:16548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22618.exe
        5⤵
        
        PID:5896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40336.exe
        6⤵
        
        PID:7908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63379.exe
        6⤵
        
        PID:11272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56753.exe
        6⤵
        
        PID:4384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60055.exe
        5⤵
        
        PID:7444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43090.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9132.exe
        5⤵
        
        PID:10684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-366.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-366.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46568.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59796.exe
        6⤵
        
        PID:7408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53696.exe
        7⤵
        
        PID:9732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29518.exe
        7⤵
        
        PID:14356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42357.exe
        7⤵
        
        PID:16580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46009.exe
        7⤵
        
        PID:11152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25521.exe
        6⤵
        
        PID:12480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27096.exe
        6⤵
        
        PID:4340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28917.exe
        5⤵
        
        PID:8980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57619.exe
        5⤵
        
        PID:12844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48088.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12233.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12233.exe
      4⤵
      PID:5428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36060.exe
        5⤵
        
        PID:7704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14506.exe
        6⤵
        
        PID:16276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63379.exe
        5⤵
        
        PID:11296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58916.exe
        5⤵
        
        PID:12356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54435.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54435.exe
      4⤵
      PID:8596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52462.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52462.exe
      4⤵
      PID:12264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12092.exe
      4⤵
      PID:14780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-925.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-925.exe
      4⤵
      PID:11072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63546.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63546.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3895.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3895.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7891.exe
        5⤵
        
        PID:656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54264.exe
        6⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23372.exe
        7⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7650.exe
        7⤵
        
        PID:13292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48312.exe
        7⤵
        
        PID:10648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32862.exe
        6⤵
        
        PID:9220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8941.exe
        6⤵
        
        PID:13068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15995.exe
        6⤵
        
        PID:5004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25475.exe
        6⤵
        
        PID:10508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28534.exe
        5⤵
        
        PID:6956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2759.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53468.exe
        7⤵
        
        PID:15272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35152.exe
        7⤵
        
        PID:10336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32154.exe
        6⤵
        
        PID:11508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31619.exe
        6⤵
        
        PID:5168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49901.exe
        6⤵
        
        PID:10456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60638.exe
        5⤵
        
        PID:9800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30064.exe
        6⤵
        
        PID:12816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30328.exe
        6⤵
        
        PID:4556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10722.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35472.exe
        5⤵
        
        PID:6304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22618.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22618.exe
      4⤵
      PID:5648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21836.exe
        5⤵
        
        PID:8488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14506.exe
        6⤵
        
        PID:16284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4578.exe
        5⤵
        
        PID:12192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50888.exe
        5⤵
        
        PID:2120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62986.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62986.exe
      4⤵
      PID:5600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39171.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39171.exe
      4⤵
      PID:11588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54578.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54578.exe
      4⤵
      PID:16316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15882.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15882.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21104.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21104.exe
      4⤵
      PID:2368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55800.exe
        5⤵
        
        PID:6628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58792.exe
        6⤵
        
        PID:9464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45715.exe
        6⤵
        
        PID:14300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11199.exe
        6⤵
        
        PID:15368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5552.exe
        6⤵
        
        PID:6684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31526.exe
        5⤵
        
        PID:10100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12169.exe
        5⤵
        
        PID:13536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44138.exe
        5⤵
        
        PID:15764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35114.exe
      4⤵
      PID:6316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22420.exe
        5⤵
        
        PID:8516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45802.exe
        5⤵
        
        PID:3640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57988.exe
        5⤵
        
        PID:15684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17633.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17633.exe
      4⤵
      PID:10776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7816.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7816.exe
      4⤵
      PID:7008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43110.exe
      4⤵
      PID:11832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61758.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61758.exe
    3⤵
    PID:5968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3195.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3195.exe
      4⤵
      PID:7624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55211.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55211.exe
      4⤵
      PID:10688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56753.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56753.exe
      4⤵
      PID:552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24382.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24382.exe
    3⤵
    PID:7476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10847.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10847.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8376.exe
      4⤵
      PID:16236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63516.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63516.exe
    3⤵
    PID:11928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23672.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23672.exe
    3⤵
    PID:15564
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29809.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29809.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13355.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13355.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4139.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4139.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60688.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22500.exe
        6⤵
        
        PID:3564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42676.exe
        7⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7087.exe
        8⤵
        
        PID:7948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23462.exe
        8⤵
        
        PID:11432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17307.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41850.exe
        7⤵
        
        PID:8152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9569.exe
        7⤵
        
        PID:12060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16567.exe
        7⤵
        
        PID:6320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42188.exe
        7⤵
        
        PID:11972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57403.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40092.exe
        7⤵
        
        PID:8560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32154.exe
        7⤵
        
        PID:11956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8568.exe
        7⤵
        
        PID:16536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49722.exe
        6⤵
        
        PID:8540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51755.exe
        6⤵
        
        PID:11452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31388.exe
        6⤵
        
        PID:16460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46355.exe
        5⤵
        
        PID:5148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57336.exe
        6⤵
        
        PID:6344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1999.exe
        7⤵
        
        PID:10212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5066.exe
        7⤵
        
        PID:13872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25096.exe
        7⤵
        
        PID:2256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12450.exe
        6⤵
        
        PID:10256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45802.exe
        6⤵
        
        PID:4656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49353.exe
        6⤵
        
        PID:5628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49596.exe
        6⤵
        
        PID:9296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49390.exe
        5⤵
        
        PID:7576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24792.exe
        6⤵
        
        PID:13868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40873.exe
        6⤵
        
        PID:16852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62367.exe
        5⤵
        
        PID:10152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45340.exe
        5⤵
        
        PID:5708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21362.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21362.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36096.exe
        5⤵
        
        PID:452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10387.exe
        6⤵
        
        PID:4444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7087.exe
        7⤵
        
        PID:7956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40262.exe
        8⤵
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35418.exe
        7⤵
        
        PID:12496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64921.exe
        7⤵
        
        PID:5732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34834.exe
        6⤵
        
        PID:8532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46902.exe
        6⤵
        
        PID:12236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37293.exe
        6⤵
        
        PID:8116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54640.exe
        6⤵
        
        PID:11976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57070.exe
        5⤵
        
        PID:6236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51960.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32154.exe
        6⤵
        
        PID:12224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7855.exe
        6⤵
        
        PID:10992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8174.exe
        5⤵
        
        PID:9652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6141.exe
        5⤵
        
        PID:13648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59970.exe
        5⤵
        
        PID:13868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19249.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19249.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47632.exe
        5⤵
        
        PID:6616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30204.exe
        6⤵
        
        PID:9372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50567.exe
        6⤵
        
        PID:13644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59056.exe
        6⤵
        
        PID:6664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31526.exe
        5⤵
        
        PID:10088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12169.exe
        5⤵
        
        PID:13592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22794.exe
        5⤵
        
        PID:16404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31021.exe
      4⤵
      PID:7972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17862.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17862.exe
      4⤵
      PID:11424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3351.exe
      4⤵
      PID:15520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62063.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62063.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18970.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18970.exe
      4⤵
      PID:1700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46184.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27700.exe
        6⤵
        
        PID:7664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37152.exe
        7⤵
        
        PID:3748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61332.exe
        7⤵
        
        PID:12020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63379.exe
        6⤵
        
        PID:11120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56753.exe
        6⤵
        
        PID:4828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29982.exe
        5⤵
        
        PID:7516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-951.exe
        6⤵
        
        PID:15100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33068.exe
        6⤵
        
        PID:2828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-249.exe
        5⤵
        
        PID:11884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54284.exe
        5⤵
        
        PID:16156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63354.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63354.exe
      4⤵
      PID:6452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64404.exe
        5⤵
        
        PID:8680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32154.exe
        5⤵
        
        PID:12024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4484.exe
        5⤵
        
        PID:6900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6770.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6770.exe
      4⤵
      PID:9164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18585.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18585.exe
      4⤵
      PID:12148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25852.exe
      4⤵
      PID:12016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14101.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14101.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51450.exe
      4⤵
      PID:6908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52152.exe
        5⤵
        
        PID:8640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32154.exe
        5⤵
        
        PID:11796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37157.exe
        5⤵
        
        PID:5344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55587.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55587.exe
      4⤵
      PID:8964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6141.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6141.exe
      4⤵
      PID:13092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18937.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18937.exe
      4⤵
      PID:15740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42219.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42219.exe
    3⤵
    PID:5700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36060.exe
      4⤵
      PID:7688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53468.exe
        5⤵
        
        PID:14432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2864.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63379.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63379.exe
      4⤵
      PID:11080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56753.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56753.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23813.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23813.exe
    3⤵
    PID:8184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13970.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13970.exe
    3⤵
    PID:11596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5188.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5188.exe
    3⤵
    PID:6184
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25343.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25343.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32920.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32920.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28784.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28784.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51280.exe
        5⤵
        
        PID:1356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63672.exe
        6⤵
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13859.exe
        7⤵
        
        PID:8576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16725.exe
        7⤵
        
        PID:13216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57028.exe
        7⤵
        
        PID:5392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53488.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46022.exe
        6⤵
        
        PID:5084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51755.exe
        6⤵
        
        PID:11472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53215.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26561.exe
        5⤵
        
        PID:6756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18336.exe
        6⤵
        
        PID:8320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50183.exe
        6⤵
        
        PID:13992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34188.exe
        6⤵
        
        PID:16608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16421.exe
        5⤵
        
        PID:9968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31022.exe
        5⤵
        
        PID:13632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2214.exe
        5⤵
        
        PID:5904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16998.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16998.exe
      4⤵
      PID:3128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10086.exe
        5⤵
        
        PID:7016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27648.exe
        6⤵
        
        PID:8592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32154.exe
        6⤵
        
        PID:12044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28303.exe
        6⤵
        
        PID:16016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38622.exe
        5⤵
        
        PID:8920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35227.exe
        5⤵
        
        PID:12976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35472.exe
        5⤵
        
        PID:1160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15461.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15461.exe
      4⤵
      PID:6948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1223.exe
        5⤵
        
        PID:8876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45227.exe
        5⤵
        
        PID:12300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42803.exe
        5⤵
        
        PID:5324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21312.exe
        5⤵
        
        PID:8200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31083.exe
      4⤵
      PID:8744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43090.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43090.exe
      4⤵
      PID:11696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32787.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32787.exe
      4⤵
      PID:16132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13194.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13194.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36096.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36096.exe
      4⤵
      PID:3328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26125.exe
        5⤵
        
        PID:6636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54464.exe
        6⤵
        
        PID:9568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63727.exe
        6⤵
        
        PID:15236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8978.exe
        6⤵
        
        PID:4972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51127.exe
        5⤵
        
        PID:9996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9369.exe
        5⤵
        
        PID:13580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50686.exe
        5⤵
        
        PID:16600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20889.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20889.exe
      4⤵
      PID:6464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26696.exe
        5⤵
        
        PID:9408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58543.exe
        5⤵
        
        PID:14172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52123.exe
        5⤵
        
        PID:15408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34791.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34791.exe
      4⤵
      PID:6972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61502.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61502.exe
      4⤵
      PID:13380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-772.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-772.exe
      4⤵
      PID:10304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27225.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27225.exe
    3⤵
    PID:3620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31104.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31104.exe
      4⤵
      PID:6612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13291.exe
        5⤵
        
        PID:10104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45175.exe
        5⤵
        
        PID:13732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15283.exe
        5⤵
        
        PID:5080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33565.exe
        5⤵
        
        PID:10624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3514.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3514.exe
      4⤵
      PID:9932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64302.exe
      4⤵
      PID:6424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43022.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43022.exe
      4⤵
      PID:5188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29059.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29059.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52352.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52352.exe
      4⤵
      PID:10724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2902.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2902.exe
      4⤵
      PID:14364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23807.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23807.exe
      4⤵
      PID:10652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27085.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27085.exe
    3⤵
    PID:10580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26466.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26466.exe
    3⤵
    PID:13048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48255.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48255.exe
    3⤵
    PID:16912
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32157.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32157.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4471.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4471.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23844.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23844.exe
      4⤵
      PID:3344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18364.exe
        5⤵
        
        PID:5408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43984.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32154.exe
        6⤵
        
        PID:11784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46057.exe
        6⤵
        
        PID:6388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34834.exe
        5⤵
        
        PID:8544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46902.exe
        5⤵
        
        PID:12228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52669.exe
        5⤵
        
        PID:4792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50351.exe
      4⤵
      PID:6736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56236.exe
        5⤵
        
        PID:8864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32154.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4484.exe
        5⤵
        
        PID:6312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49722.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49722.exe
      4⤵
      PID:8468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51755.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51755.exe
      4⤵
      PID:12296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25667.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25667.exe
      4⤵
      PID:8752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5514.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5514.exe
    3⤵
    PID:5224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45084.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45084.exe
      4⤵
      PID:3436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44620.exe
        5⤵
        
        PID:13372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11361.exe
        5⤵
        
        PID:4508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12450.exe
      4⤵
      PID:10264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4001.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4001.exe
      4⤵
      PID:14188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59358.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59358.exe
      4⤵
      PID:16512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49390.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49390.exe
    3⤵
    PID:7568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29820.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29820.exe
      4⤵
      PID:9836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61703.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61703.exe
      4⤵
      PID:13424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16928.exe
      4⤵
      PID:7044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10478.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10478.exe
    3⤵
    PID:10236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1201.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1201.exe
    3⤵
    PID:14200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60305.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60305.exe
    3⤵
    PID:17116
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15186.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15186.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47699.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47699.exe
    3⤵
    PID:5544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26304.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26304.exe
      4⤵
      PID:9056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7650.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7650.exe
      4⤵
      PID:11756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7855.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7855.exe
      4⤵
      PID:17068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2302.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2302.exe
    3⤵
    PID:8464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37152.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37152.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65224.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65224.exe
      4⤵
      PID:12124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43090.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43090.exe
    3⤵
    PID:11568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13737.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13737.exe
    3⤵
    PID:1236
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34084.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34084.exe
  2⤵
  PID:5680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15255.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15255.exe
    3⤵
    PID:7984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52243.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52243.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:11492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21148.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21148.exe
    3⤵
    PID:6064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41236.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41236.exe
    3⤵
    PID:7388
- C:\Users\Admin\AppData\Local\Temp\Unicorn-2813.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-2813.exe
  2⤵
  PID:8172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53468.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53468.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:13544
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4170.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4170.exe
  2⤵
  PID:11580
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28149.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28149.exe
  2⤵
  PID:8216
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19048.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19048.exe
  2⤵
  PID:12368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 11896 -ip 11896
1⤵
PID:15340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 14400 -ip 14400
1⤵
PID:13496

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11990.exe

Filesize
468KB

MD5
4d42e35b9cb226231489fcbbaf6b65ba

SHA1
add5408d64393f2b08c815bf65dd0689a817d30e

SHA256
3c8c0ac70167461fda78f92a8323fd70f615e96b5635bf3842a196887f102feb

SHA512
e8ef8c13d7378d99a0ebc10097e4e20b81305525c14aa47a4246a22839287779e028338b5200d80d76814878df6620dee50d0bb752f8ac41b7d2774fb93ec73c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13355.exe

Filesize
468KB

MD5
fc8b1cb159641f8baf6d43ddac695553

SHA1
e9174a206fb47251a9ffc0f43f95e775e317218f

SHA256
6473d8e172960c3f9e54475bb76ac985171388b72ae8e862d2efc8a12742fb58

SHA512
1a2640a80de226e41a9a7eb2d1bc1040bcc823c5ef9ff5d54f9bdb3bdb8d09f16de79a3b23bd8a2ae04ddf8691f013dae6a44131ee1fa150dc9e2bbe69a9503c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16930.exe

Filesize
468KB

MD5
9d69fec16fcecec76c4df0f13a053ddd

SHA1
5025739750c017b16f2d9db1acc1cfeb16485c7f

SHA256
f84c1e1b2ab53e85bfa89770789f1b2e100f4c4d82565d3872f1deaac471ac75

SHA512
fe793b3285054324832a26772608238150e185eff2b0284ccce9661b20a5ee884cbe5d7b7d551dd1488eb067748da1a0ab27ef744be53e0017b37338c1b2e54a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16968.exe

Filesize
468KB

MD5
3569de7d2bd1ab392b7a787cb5d51781

SHA1
1b9ee463662d699a028c48b81e3b892c8c0e9a0c

SHA256
e13b5aaf63c08b18031c86f900c3783780965ac7e10b03004232592fb36d2096

SHA512
b8ef6004c04e7fda0401fa00a90b150c918b362006098b3bcfc3d6f78a91a72f3bef9ed3672c90ce6e118aa157c2e2814d95c2dc716ece47b1ea2394a8c5b925

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22100.exe

Filesize
468KB

MD5
057fe2d0c79d3fb026cc621f9cfc881c

SHA1
96997219af999acfa61748dff823796f74dd8771

SHA256
42987f0b05bdc6e7c0da73669755f9ab93cef9e40b5bc22c8d379d95bf1a0cfb

SHA512
bb3b94fbd18efe5275e1c2bf59bb0a9ee2de75a6a9f3b0b375d146e1942ba55f090329b6f4b032345f76fc028a8bc55280edf6c121ae3b278a363e74fd1f6d9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22728.exe

Filesize
468KB

MD5
be13910e5a75b8363170dd25ae52ce0b

SHA1
953a56ae3f779f369bd8a03b17f9dac1dccb4a7b

SHA256
21a133a54c0254057af0bde0d3be1506f2a4eff0556aee5f4eeee73395d7896a

SHA512
8b4c21c4587b5c4186d3e450854a013f2d25323163f2c43636f3ac6f6bbe2e95cc357aaf1e1d1ca0eb6119bd7376af2f45426113145b9cca79daf96815c718d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25343.exe

Filesize
468KB

MD5
80304b4e6011609feb68223f9a75faba

SHA1
3c72c2f7eacd84c3d1471e193db72e3e85b33fad

SHA256
e25077f0f6ca1a66352b1a00af7d083279daf64bfe87b2dc3b44e77da488ee6a

SHA512
9fa8b39a42ee288fac0a47ec857b03610d010222392fe026f0cc785caba94f73927795f3c9745bcfe830e1416c422fb56900735651c437bd9c55029ec4ef8054

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28016.exe

Filesize
468KB

MD5
01d474f8df0e23a7667ef81f6e396220

SHA1
547cf22dd5052b4f9983740f31adbacfc8c93aeb

SHA256
6b562fff32e72c3431adc597061ca002c035566463d22e65698c7b927f5fd672

SHA512
427678b9df7b44f96d619740a5520dd443d384e15d8cbdc559d2e99cb94f7c4133b8a4405cd2309444448c16a3023ce187e958a68aafc501ed6c7aa2ed44ae86

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28644.exe

Filesize
468KB

MD5
ea492c1847d0a789d18fb7f1a35c0e68

SHA1
4bc36ae5be8729933e9fbede15855f8fec7bcef2

SHA256
956f3c5b9dd64318d6435d44ebc6de8caab26c33e13197463b1542043827295b

SHA512
30ab0da7d86943256752041e5053f4bb940b375f640d63f9f1aae1ceb49b5c7e5e5c166e9c8e2fa19e8df1068e3ae069aab58d41ee15ba5d62655bec6c6555ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29809.exe

Filesize
468KB

MD5
73f58bcbbe413fb48bd8e9334a45b880

SHA1
8eb167300f5e53aa5c4cf47498d74a1d9871db3a

SHA256
91427a41204f48ecea108c9a7db5cf714ce89921f0651c8d0f31fab456501e20

SHA512
f8c13d226ca7dcbc059229df6f684a9efbda5f40ee311b2c2c218ca0beea741964a5569d2be6244bf49239e0433409ce77680aad84d848a0dafd42546834a8a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32157.exe

Filesize
468KB

MD5
6af0014ce6b44774f8bde64b2d53631e

SHA1
559f5ff5cb991ee331c842bd7e2ab8f9d0adefb4

SHA256
830b688e3771f592c59b516ca72e9f3b036464a3ee72ef10b1d397618aab78ae

SHA512
872d2928ef6d7505836aefc820e45f395c930f88b140c0d55da8e053d0a43d3b7a81abd9ac90735b6b8d520952035519f16945932bba722e990a5bf44ae2ab53

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32520.exe

Filesize
468KB

MD5
8aef6bd35f0e3092fda1a7d0b41c5ebb

SHA1
59a3eae1ce534f56ec12c23f395eda24977194d0

SHA256
4e8ee0e40f3ccf3c2d5f68d224072d99b86f72f3ec1da1a8561bdcc3ddc29af9

SHA512
c525c39db89dd01a46b6a43d039c3195780f159ac07cb074a619f61a977060cc11196327a5ab0ce194270619466b067cd137760e43ee2a242f2ff84112b9d6ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32728.exe

Filesize
468KB

MD5
e5e30ccb2786817939d9f30acbe694a8

SHA1
5fc01a476981d6930ae8d3ecfe36ca2fcc66e68d

SHA256
753b0cb82472e395ba47b7cdce4bf2397d1411a67f709ee011558731247f713d

SHA512
fd93d386d089d28800efbb4fcecdfa4db393274fd56dccde41001204830e90ff8dc1fd4185341a43954fe1a5c30479d524fa6f7c7942ee17a71d78b618100d47

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32846.exe

Filesize
468KB

MD5
20f25a786501038736e104587d6a66e9

SHA1
617b16c55bbd3de791666b9b5154e6f319a2583b

SHA256
75e760405a81edcb68c095f8888f5d983771f31403f0b879a01cec443fbc443c

SHA512
22e3512563778b7593820ac0610c59f15a814b66dd46aa4152f1288fac3bdc9dd98dbee19dcbad240d233c3ff1188673ba9df5da2826788228c880376870d5b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32920.exe

Filesize
468KB

MD5
b992cee14955dd55000abaa4027c69fb

SHA1
0efcefac1d6d42e02d80c0b6fa010a0254f71394

SHA256
fd877ccfb6678046e3c48b7d7a7daf6bc8de4ae8d57ba1656db23c13d342fb46

SHA512
155c38cc836999c33676c6143201449c03e2ffa31776a86584ccb43818a86ae6f8f04fd8686ef47626858e939b0eca38434a1edcf32b3a2d30ea104de8413cd6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34300.exe

Filesize
468KB

MD5
c564b4e12cdc46d9b4b78542808bc2ea

SHA1
63d6b0aa0424f707603aac884bf6a50620f2bbc4

SHA256
5d16ae002f9af1702f1b4ebeaf7c4681bf2e3a2aa9b2b29462881144b2dff74e

SHA512
09c0e0e0caa83f42729b0c5c8e6264956dd9499ef8b701abb6a948b56c927e2da0473b00078e6c88a0fcc0e62d566d2a2011d8ceb5e38ab92c2a2de77dfb1803

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36739.exe

Filesize
468KB

MD5
5da54f258d4e4b8407c8308d5c244a33

SHA1
2fb6953b3dbdc5e9c0165a4355fd9cedbde79c28

SHA256
2aa24030e2ffe707753b8695e74638c867c66fb76eaff6380eace3a7ccb3c45b

SHA512
b963403990f060a2fe074a72e453244e88ab4362660dd46bb90f25881a4cb360b12a5057ce9d1440f57fca8ae223a74b7db6ea979d1038e6126ca1186d670082

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37750.exe

Filesize
468KB

MD5
0b5a537212a3b9411a979b86c94cba5b

SHA1
0ba8ee2edc8a6f97dc94065f53a1fccfd43a210a

SHA256
0348761ca6256777141165bb23b50cfcf1c6b8bb76acaff5ef389581fac28fc0

SHA512
e04f76edaae8b5c11ab85236b3b859acaa67e2cd9921318186779fe49f7fa9de8fae699549fa7cfbacefbfce5111738b6eb64144c900f54c0fa75b700a555266

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37860.exe

Filesize
468KB

MD5
2f4d5b9ef530c4a9340dab1fb6c19895

SHA1
4f570659c307fc68540646a1d6485a6becf079b9

SHA256
e2fc2649a4567b7132f4373f341b7d6594167493a5e5f495dd1b42858fda66db

SHA512
ba4c9e27272b1b1802c51ad8d444a6202137d50362c06261ae01ae329e3dbfeca6104505f01aabed93b08f46bd1bfedc9be2c0b85bbac26a1465f78714de72c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40024.exe

Filesize
468KB

MD5
d1d88716e788dd013bb3c5e2a33fcb2e

SHA1
1ed42c677172e3ae6f49227a8cf8ea0acf5128ea

SHA256
6e193b1f51d538db0b391458a0bfc2d09119c89ff020a41372e9af088ae26779

SHA512
1b5f77d099c77cd2902b5ca41de7c57e244f5996e7222e4f9c3fd091873097add624add900364cafb5821ad18a0f0e76ba0f6c6f3e8760bb62537fa62447a968

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41088.exe

Filesize
468KB

MD5
e6c063b25b7893b37c0db9fa6037906e

SHA1
28f6cf8e3cbd95e06cdc4ca9798fcc5f355541c2

SHA256
18e72bc85fd7a0c56771e170e22b5c64a4c74a79446ebd1d1597649d8679ad45

SHA512
68ed0df2a4be21643084a8ea03154d436f59ffc7069b89fe145dcd49321606084409ca1478e2aabf72effc209211bed5c7bd8c5daf02cc00d8cc44051b5182f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4139.exe

Filesize
468KB

MD5
2678178962a9c1f17e27ee6792fc5e3e

SHA1
a8c35563439320340210cb502f5aba721a598c47

SHA256
585c5f9d879fccb380ac27f29eeb0e561a6ffadcd3bcb742d1c5f27e5ae2d89d

SHA512
fc6847974ebb8b774f4d4b6770bd7f7cfe56a0d344d3ed2232e9c3af25f97a59b84b1e6c5b2b1bd0fa0e8c240f53ac74db2af1181dba072528fee78062c51046

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42690.exe

Filesize
468KB

MD5
7f2b6bc079043ea660d381a9ebd2de5e

SHA1
03624a909021f939da84876f10803f642e949e22

SHA256
d534701fa0eebe83d2a00e962968c3b57fec6e27f274cff6cc55d241fa9a06bd

SHA512
84cd2e46a47d04cbe9987f38d3a029d5e77d0cab1c351ee35608206a48c1c79d6cbeaee10b7930894b022e39ab78d7a2d42143d5b6e1e1feaedec4313009274c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49811.exe

Filesize
468KB

MD5
e29dcca14bfb7c04931ac144d9e9b603

SHA1
cab33c930e54e347edbf354cb7dd92dc48eead1d

SHA256
64a897318285ebeaec2bf1a4e72f55b31cc9497ce58a2c9b35f14dd191432234

SHA512
7bafb9ca17e1805b08c41baca8bd5b863a8a9532232dc77e9188dde7801d6a30b8c52bc356562432b3a042d2c7840845cb9f4ee6546153bb01c7a7518d2d9efa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52150.exe

Filesize
468KB

MD5
086314183d0bca9680747b6ddb49ee54

SHA1
823420a19bf6e305a8f289cadae9f59cec6821ff

SHA256
9e7e8785345184d165b262d0bf80ad62722a2b1ae7c67b4d3c0bd4c7c066c27d

SHA512
82ff019860b7b89a708f220ee63719c98af2e6a9cd5068d223338d070ab92be8d88c8e573ccfdcfe0a7b6d7c0083460f57428d5be198a51d73ed74a6a66e24ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58280.exe

Filesize
468KB

MD5
8d8d9a012686cd9454b264c41d1d0bcd

SHA1
e6c95e2a327f45b826b99ccd757dcbc72523ee4a

SHA256
f2e346c5c7b695121f321d1ef6a91806e85f67b8d37bf2bc30cc918b56ef14f5

SHA512
763f49e03f479e297ca8e2553147d7960a35e7c37527c4a8e6ddc19cdcce8397a2f764faf0413befcae00f9991a58ff7196ba399cc22ca02a5abea4b9e4c17ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-610.exe

Filesize
468KB

MD5
1db512c9975a829f1585739e53cb99e5

SHA1
33e1b21fc194feee55624a8292359d0efe22dd09

SHA256
bad44f1e0085b8e92fb5bea452d3bf78d1cc81c56dfea37893098c7e51deda57

SHA512
29bc31d25b431bb363255a9c519f05419cf8d636ab5bdf278c8c38125f14407f6dacbc4ddceebebf3a8364235a889f8e695bf2cdda0ea1565fcf1965da4d4d09

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62063.exe

Filesize
468KB

MD5
f8d2d7293b5c05c4c0d4b463868de22f

SHA1
3317fc7d6e794a1646ef16c6902e2271980fdd92

SHA256
f655c32888d20f9396aec48d84526578badb3164b3625c89787c3af27dae333c

SHA512
64d489adab1feed259e955548334a0365450b412daaf1f762f25dca473a8b7f8739ecf359fa64b3dd5a538c82922386736e6b5f3a9baa22a756f164ca7702953

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63546.exe

Filesize
468KB

MD5
22d68d797e63c649e8daaf4bbcfa0867

SHA1
d816da3315dcf88b260c822e8a6cde158fca58ee

SHA256
640b55ff09ee14b13d4a0f5f090c292ba93f39923d4e012c070b0c319a2db532

SHA512
78172afb247cba68cbe08992d83582dc4492f29992ba284193f2de47a4297c981069cfd8e50bc7399b5332828e2496701f3604c92376c210c515b99ed7026bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9826.exe

Filesize
468KB

MD5
4aa8c03eb612f0e96219aa87250e180c

SHA1
1dc1359bce29d1473b712196df134f3a948fcdcc

SHA256
aa76430e6ce9b22f3606304dd96ad2ebd1dabff18b4abe114dc19a9ac06fe579

SHA512
8523db7897a0a521d1263837705f500fbcc65f26b44d5615a79b12b5005724c383933e4ec5bfa23e871e8272fa15c09c6464c1f900accaa34e6ff0ed3bf404d4

Download Submit
memory/208-398-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/232-328-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/368-312-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/392-201-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/400-440-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/404-293-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/452-420-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/516-198-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/592-62-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/644-44-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/756-124-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1004-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1164-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1192-169-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1204-234-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1212-308-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1356-404-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1360-107-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1420-313-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1436-270-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1700-403-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1752-399-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1836-391-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1840-102-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1928-14-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1984-233-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1992-80-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2012-397-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2032-326-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2308-55-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2368-476-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2440-190-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2504-273-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2644-310-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2772-473-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2832-311-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2912-402-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2928-163-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2940-205-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3064-33-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3128-472-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3168-486-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3204-100-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3288-45-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3296-91-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3308-474-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3344-419-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3348-330-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3408-104-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3500-276-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3540-166-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3572-382-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3620-491-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3624-21-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3728-327-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3768-245-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3992-329-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4060-331-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4076-119-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4088-111-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4116-347-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4136-235-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4180-431-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4248-168-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4344-222-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4440-167-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4468-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4492-170-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4504-385-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4512-225-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4520-477-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4580-387-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4620-259-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4668-490-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4724-214-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4804-383-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4812-475-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4852-439-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4868-249-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4960-256-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4964-489-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4988-381-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5096-309-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5148-492-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5208-497-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5216-498-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5224-499-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5336-533-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5352-535-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5380-537-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5412-564-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5496-561-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5508-562-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5560-563-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5632-575-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5672-601-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads