510385721a21935e408f30c21a8a159b194af796671a7e0a46fb70979681f845

Analysis

max time kernel
120s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2024, 00:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

510385721a21935e408f30c21a8a159b194af796671a7e0a46fb70979681f845N.exe
Size

468KB
MD5

35a39fe827995533198200ebb9350980
SHA1

482a54f5ee1673f66120e53ae2ac3716bcdb47af
SHA256

510385721a21935e408f30c21a8a159b194af796671a7e0a46fb70979681f845
SHA512

f4973f3f9b2b62d3243ef4ecac5b8baa7c310fa969983c9250d9071ded6ce8621ea3872383c047e2ef6bf61b4d0e1d8facbc88b7b0aaf3666ed3be0df3ca2f1d
SSDEEP

3072:auNhogfxjg8UYbYZPUGcqf8/7C3jyIgZPwfI+V8rHx0X920Mt5MJ:auTogNUYaPLcqfQV3THxa80Mt

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4988	Unicorn-20995.exe
2908	Unicorn-12278.exe
4948	Unicorn-26455.exe
1400	Unicorn-46196.exe
1164	Unicorn-23921.exe
2192	Unicorn-7127.exe
2012	Unicorn-20862.exe
1128	Unicorn-2166.exe
4868	Unicorn-30065.exe
4620	Unicorn-6655.exe
1924	Unicorn-525.exe
4980	Unicorn-6390.exe
4960	Unicorn-52327.exe
2276	Unicorn-5079.exe
3780	Unicorn-18814.exe
3068	Unicorn-53367.exe
952	Unicorn-17736.exe
436	Unicorn-15204.exe
2796	Unicorn-25049.exe
2888	Unicorn-28386.exe
2032	Unicorn-28386.exe
1356	Unicorn-26004.exe
516	Unicorn-3305.exe
1936	Unicorn-13549.exe
3676	Unicorn-7419.exe
4920	Unicorn-19558.exe
3332	Unicorn-23171.exe
2872	Unicorn-9861.exe
2600	Unicorn-20312.exe
3136	Unicorn-64485.exe
3644	Unicorn-47639.exe
5036	Unicorn-58341.exe
4940	Unicorn-8289.exe
3048	Unicorn-62939.exe
2160	Unicorn-11137.exe
1560	Unicorn-53074.exe
3232	Unicorn-27883.exe
4860	Unicorn-22673.exe
4064	Unicorn-19191.exe
3076	Unicorn-62086.exe
2632	Unicorn-57317.exe
1500	Unicorn-21739.exe
3712	Unicorn-31080.exe
3204	Unicorn-31080.exe
5084	Unicorn-9974.exe
3372	Unicorn-25460.exe
3524	Unicorn-19329.exe
316	Unicorn-8847.exe
4832	Unicorn-14447.exe
1868	Unicorn-33887.exe
4696	Unicorn-14286.exe
3156	Unicorn-49812.exe
4104	Unicorn-359.exe
2168	Unicorn-63052.exe
2228	Unicorn-60276.exe
736	Unicorn-38409.exe
4944	Unicorn-13000.exe
708	Unicorn-49264.exe
4236	Unicorn-20840.exe
5032	Unicorn-4207.exe
4804	Unicorn-24073.exe
4344	Unicorn-4046.exe
3328	Unicorn-24073.exe
3600	Unicorn-45437.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62284.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19185.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29356.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58908.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10804.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33887.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54857.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51148.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37070.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49512.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25422.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58316.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51148.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43115.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10804.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53074.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46839.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61410.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36495.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28201.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-785.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22673.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1779.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6015.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5801.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24052.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46073.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34604.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50831.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57292.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8729.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25049.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30280.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8004.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10482.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42266.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16669.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25714.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19425.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35720.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24052.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28303.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11397.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57573.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1449.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15916.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48883.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54466.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24570.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30821.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40556.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54906.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20312.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18159.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10804.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13525.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37484.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-413.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36203.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29170.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59922.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19893.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42401.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	15552	dwm.exe
Token: SeChangeNotifyPrivilege	15552	dwm.exe
Token: 33	15552	dwm.exe
Token: SeIncBasePriorityPrivilege	15552	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
772	510385721a21935e408f30c21a8a159b194af796671a7e0a46fb70979681f845N.exe
4988	Unicorn-20995.exe
2908	Unicorn-12278.exe
4948	Unicorn-26455.exe
1164	Unicorn-23921.exe
1400	Unicorn-46196.exe
2012	Unicorn-20862.exe
2192	Unicorn-7127.exe
1128	Unicorn-2166.exe
1924	Unicorn-525.exe
4980	Unicorn-6390.exe
4868	Unicorn-30065.exe
4620	Unicorn-6655.exe
4960	Unicorn-52327.exe
2276	Unicorn-5079.exe
3780	Unicorn-18814.exe
3068	Unicorn-53367.exe
952	Unicorn-17736.exe
436	Unicorn-15204.exe
2796	Unicorn-25049.exe
2888	Unicorn-28386.exe
2032	Unicorn-28386.exe
1356	Unicorn-26004.exe
4920	Unicorn-19558.exe
1936	Unicorn-13549.exe
516	Unicorn-3305.exe
3332	Unicorn-23171.exe
3676	Unicorn-7419.exe
2872	Unicorn-9861.exe
2600	Unicorn-20312.exe
3136	Unicorn-64485.exe
5036	Unicorn-58341.exe
3644	Unicorn-47639.exe
4940	Unicorn-8289.exe
3048	Unicorn-62939.exe
2160	Unicorn-11137.exe
1560	Unicorn-53074.exe
3232	Unicorn-27883.exe
4860	Unicorn-22673.exe
4064	Unicorn-19191.exe
3076	Unicorn-62086.exe
2632	Unicorn-57317.exe
5084	Unicorn-9974.exe
3524	Unicorn-19329.exe
1500	Unicorn-21739.exe
3712	Unicorn-31080.exe
3372	Unicorn-25460.exe
3204	Unicorn-31080.exe
4832	Unicorn-14447.exe
316	Unicorn-8847.exe
1868	Unicorn-33887.exe
3156	Unicorn-49812.exe
4696	Unicorn-14286.exe
4104	Unicorn-359.exe
4944	Unicorn-13000.exe
2228	Unicorn-60276.exe
2168	Unicorn-63052.exe
708	Unicorn-49264.exe
736	Unicorn-38409.exe
4236	Unicorn-20840.exe
4344	Unicorn-4046.exe
4804	Unicorn-24073.exe
3328	Unicorn-24073.exe
3600	Unicorn-45437.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 772 wrote to memory of 4988	772	510385721a21935e408f30c21a8a159b194af796671a7e0a46fb70979681f845N.exe	82
PID 772 wrote to memory of 4988	772	510385721a21935e408f30c21a8a159b194af796671a7e0a46fb70979681f845N.exe	82
PID 772 wrote to memory of 4988	772	510385721a21935e408f30c21a8a159b194af796671a7e0a46fb70979681f845N.exe	82
PID 4988 wrote to memory of 2908	4988	Unicorn-20995.exe	83
PID 4988 wrote to memory of 2908	4988	Unicorn-20995.exe	83
PID 4988 wrote to memory of 2908	4988	Unicorn-20995.exe	83
PID 772 wrote to memory of 4948	772	510385721a21935e408f30c21a8a159b194af796671a7e0a46fb70979681f845N.exe	84
PID 772 wrote to memory of 4948	772	510385721a21935e408f30c21a8a159b194af796671a7e0a46fb70979681f845N.exe	84
PID 772 wrote to memory of 4948	772	510385721a21935e408f30c21a8a159b194af796671a7e0a46fb70979681f845N.exe	84
PID 2908 wrote to memory of 1400	2908	Unicorn-12278.exe	89
PID 2908 wrote to memory of 1400	2908	Unicorn-12278.exe	89
PID 2908 wrote to memory of 1400	2908	Unicorn-12278.exe	89
PID 4948 wrote to memory of 1164	4948	Unicorn-26455.exe	90
PID 4948 wrote to memory of 1164	4948	Unicorn-26455.exe	90
PID 4948 wrote to memory of 1164	4948	Unicorn-26455.exe	90
PID 4988 wrote to memory of 2192	4988	Unicorn-20995.exe	91
PID 4988 wrote to memory of 2192	4988	Unicorn-20995.exe	91
PID 4988 wrote to memory of 2192	4988	Unicorn-20995.exe	91
PID 772 wrote to memory of 2012	772	510385721a21935e408f30c21a8a159b194af796671a7e0a46fb70979681f845N.exe	92
PID 772 wrote to memory of 2012	772	510385721a21935e408f30c21a8a159b194af796671a7e0a46fb70979681f845N.exe	92
PID 772 wrote to memory of 2012	772	510385721a21935e408f30c21a8a159b194af796671a7e0a46fb70979681f845N.exe	92
PID 1164 wrote to memory of 1128	1164	Unicorn-23921.exe	94
PID 1164 wrote to memory of 1128	1164	Unicorn-23921.exe	94
PID 1164 wrote to memory of 1128	1164	Unicorn-23921.exe	94
PID 1400 wrote to memory of 4868	1400	Unicorn-46196.exe	95
PID 1400 wrote to memory of 4868	1400	Unicorn-46196.exe	95
PID 1400 wrote to memory of 4868	1400	Unicorn-46196.exe	95
PID 2192 wrote to memory of 4620	2192	Unicorn-7127.exe	96
PID 2192 wrote to memory of 4620	2192	Unicorn-7127.exe	96
PID 2192 wrote to memory of 4620	2192	Unicorn-7127.exe	96
PID 4988 wrote to memory of 1924	4988	Unicorn-20995.exe	97
PID 4988 wrote to memory of 1924	4988	Unicorn-20995.exe	97
PID 4988 wrote to memory of 1924	4988	Unicorn-20995.exe	97
PID 772 wrote to memory of 4980	772	510385721a21935e408f30c21a8a159b194af796671a7e0a46fb70979681f845N.exe	98
PID 772 wrote to memory of 4980	772	510385721a21935e408f30c21a8a159b194af796671a7e0a46fb70979681f845N.exe	98
PID 772 wrote to memory of 4980	772	510385721a21935e408f30c21a8a159b194af796671a7e0a46fb70979681f845N.exe	98
PID 4948 wrote to memory of 4960	4948	Unicorn-26455.exe	99
PID 4948 wrote to memory of 4960	4948	Unicorn-26455.exe	99
PID 4948 wrote to memory of 4960	4948	Unicorn-26455.exe	99
PID 2012 wrote to memory of 2276	2012	Unicorn-20862.exe	102
PID 2012 wrote to memory of 2276	2012	Unicorn-20862.exe	102
PID 2012 wrote to memory of 2276	2012	Unicorn-20862.exe	102
PID 2908 wrote to memory of 3780	2908	Unicorn-12278.exe	103
PID 2908 wrote to memory of 3780	2908	Unicorn-12278.exe	103
PID 2908 wrote to memory of 3780	2908	Unicorn-12278.exe	103
PID 1128 wrote to memory of 3068	1128	Unicorn-2166.exe	104
PID 1128 wrote to memory of 3068	1128	Unicorn-2166.exe	104
PID 1128 wrote to memory of 3068	1128	Unicorn-2166.exe	104
PID 1164 wrote to memory of 952	1164	Unicorn-23921.exe	105
PID 1164 wrote to memory of 952	1164	Unicorn-23921.exe	105
PID 1164 wrote to memory of 952	1164	Unicorn-23921.exe	105
PID 1924 wrote to memory of 436	1924	Unicorn-525.exe	106
PID 1924 wrote to memory of 436	1924	Unicorn-525.exe	106
PID 1924 wrote to memory of 436	1924	Unicorn-525.exe	106
PID 4988 wrote to memory of 2796	4988	Unicorn-20995.exe	107
PID 4988 wrote to memory of 2796	4988	Unicorn-20995.exe	107
PID 4988 wrote to memory of 2796	4988	Unicorn-20995.exe	107
PID 4868 wrote to memory of 2888	4868	Unicorn-30065.exe	109
PID 4980 wrote to memory of 2032	4980	Unicorn-6390.exe	108
PID 4868 wrote to memory of 2888	4868	Unicorn-30065.exe	109
PID 4980 wrote to memory of 2032	4980	Unicorn-6390.exe	108
PID 4868 wrote to memory of 2888	4868	Unicorn-30065.exe	109
PID 4980 wrote to memory of 2032	4980	Unicorn-6390.exe	108
PID 772 wrote to memory of 1356	772	510385721a21935e408f30c21a8a159b194af796671a7e0a46fb70979681f845N.exe	110

C:\Users\Admin\AppData\Local\Temp\510385721a21935e408f30c21a8a159b194af796671a7e0a46fb70979681f845N.exe
"C:\Users\Admin\AppData\Local\Temp\510385721a21935e408f30c21a8a159b194af796671a7e0a46fb70979681f845N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:772
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20995.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20995.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12278.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12278.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46196.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46196.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30065.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28386.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21739.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60517.exe
        8⤵
        
        PID:3792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13960.exe
        9⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46830.exe
        10⤵
        
        PID:7476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37484.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:11976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38938.exe
        10⤵
        
        PID:15364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57008.exe
        10⤵
        
        PID:15168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63603.exe
        9⤵
        
        PID:8244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9628.exe
        9⤵
        
        PID:11400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34453.exe
        9⤵
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46927.exe
        8⤵
        
        PID:6728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27505.exe
        9⤵
        
        PID:8148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40556.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:12080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57008.exe
        9⤵
        
        PID:2764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64104.exe
        8⤵
        
        PID:9752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63518.exe
        8⤵
        
        PID:12540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43423.exe
        8⤵
        
        PID:1132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17230.exe
        7⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51148.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54906.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6462.exe
        8⤵
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11003.exe
        7⤵
        
        PID:7396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43014.exe
        7⤵
        
        PID:10260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62342.exe
        7⤵
        
        PID:14644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27217.exe
        7⤵
        
        PID:5224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14447.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18795.exe
        7⤵
        
        PID:4056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21233.exe
        8⤵
        
        PID:7092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49378.exe
        9⤵
        
        PID:8104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47594.exe
        9⤵
        
        PID:12280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35902.exe
        9⤵
        
        PID:9848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55444.exe
        8⤵
        
        PID:10184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41186.exe
        8⤵
        
        PID:14128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5932.exe
        8⤵
        
        PID:16308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25943.exe
        7⤵
        
        PID:6372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64994.exe
        8⤵
        
        PID:12092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10804.exe
        8⤵
        
        PID:15700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40983.exe
        7⤵
        
        PID:7184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42758.exe
        7⤵
        
        PID:13816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53936.exe
        7⤵
        
        PID:2088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25714.exe
        6⤵
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37090.exe
        7⤵
        
        PID:8900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12903.exe
        8⤵
        
        PID:13956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46073.exe
        8⤵
        
        PID:3240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27244.exe
        7⤵
        
        PID:12796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51558.exe
        7⤵
        
        PID:3672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47720.exe
        6⤵
        
        PID:7804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30229.exe
        6⤵
        
        PID:11748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60958.exe
        6⤵
        
        PID:6612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3305.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25460.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18795.exe
        7⤵
        
        PID:472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25228.exe
        8⤵
        
        PID:6472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11397.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:9956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37070.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:14028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59808.exe
        9⤵
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27247.exe
        8⤵
        
        PID:7780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26503.exe
        8⤵
        
        PID:13864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16669.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34933.exe
        7⤵
        
        PID:6628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23010.exe
        8⤵
        
        PID:13652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46073.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52848.exe
        7⤵
        
        PID:10472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63613.exe
        7⤵
        
        PID:13404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11979.exe
        6⤵
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50831.exe
        7⤵
        
        PID:8304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56810.exe
        7⤵
        
        PID:12116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57008.exe
        7⤵
        
        PID:5080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41855.exe
        6⤵
        
        PID:7824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46765.exe
        6⤵
        
        PID:11856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54466.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49812.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18795.exe
        6⤵
        
        PID:3004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18959.exe
        7⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64098.exe
        8⤵
        
        PID:11028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10598.exe
        8⤵
        
        PID:12028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22389.exe
        7⤵
        
        PID:10020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32156.exe
        7⤵
        
        PID:11988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-136.exe
        7⤵
        
        PID:1872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3442.exe
        6⤵
        
        PID:7304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13942.exe
        6⤵
        
        PID:11144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49155.exe
        6⤵
        
        PID:14392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61410.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31580.exe
        5⤵
        
        PID:5708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23278.exe
        6⤵
        
        PID:7320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17673.exe
        7⤵
        
        PID:13664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24443.exe
        7⤵
        
        PID:9728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59879.exe
        6⤵
        
        PID:11108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32147.exe
        6⤵
        
        PID:14420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50989.exe
        6⤵
        
        PID:5664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44675.exe
        5⤵
        
        PID:7704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8808.exe
        5⤵
        
        PID:10580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15916.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63662.exe
        5⤵
        
        PID:5596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18814.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18814.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9861.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20433.exe
        6⤵
        
        PID:4084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59501.exe
        7⤵
        
        PID:6928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49378.exe
        8⤵
        
        PID:7812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10598.exe
        8⤵
        
        PID:12020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57008.exe
        8⤵
        
        PID:15828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35711.exe
        7⤵
        
        PID:7796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57561.exe
        7⤵
        
        PID:12820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26357.exe
        7⤵
        
        PID:15404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60293.exe
        6⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53227.exe
        7⤵
        
        PID:6564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38379.exe
        8⤵
        
        PID:14084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50515.exe
        8⤵
        
        PID:1604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36201.exe
        7⤵
        
        PID:10620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35720.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28133.exe
        6⤵
        
        PID:7992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30229.exe
        6⤵
        
        PID:11824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36007.exe
        6⤵
        
        PID:15668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13000.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36203.exe
        6⤵
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51148.exe
        7⤵
        
        PID:8044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28143.exe
        7⤵
        
        PID:10608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24052.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35902.exe
        7⤵
        
        PID:9888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35954.exe
        6⤵
        
        PID:7052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38379.exe
        7⤵
        
        PID:14100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47443.exe
        7⤵
        
        PID:2676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12786.exe
        6⤵
        
        PID:10908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30047.exe
        6⤵
        
        PID:13848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31907.exe
        6⤵
        
        PID:6640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25714.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52331.exe
        6⤵
        
        PID:8516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25196.exe
        6⤵
        
        PID:12480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16669.exe
        6⤵
        
        PID:3584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35551.exe
        5⤵
        
        PID:7844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30229.exe
        5⤵
        
        PID:11740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42401.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20312.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20312.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-359.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17926.exe
        6⤵
        
        PID:4352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18959.exe
        7⤵
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51596.exe
        8⤵
        
        PID:10084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18421.exe
        8⤵
        
        PID:13308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6344.exe
        7⤵
        
        PID:10204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26095.exe
        7⤵
        
        PID:13224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16669.exe
        7⤵
        
        PID:4556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23669.exe
        6⤵
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39403.exe
        7⤵
        
        PID:15112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57462.exe
        7⤵
        
        PID:15912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35315.exe
        6⤵
        
        PID:9476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51700.exe
        6⤵
        
        PID:13548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16821.exe
        6⤵
        
        PID:3724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11979.exe
        5⤵
        
        PID:5776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38659.exe
        6⤵
        
        PID:10112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18421.exe
        6⤵
        
        PID:10704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49637.exe
        5⤵
        
        PID:8964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14496.exe
        5⤵
        
        PID:11792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34962.exe
        5⤵
        
        PID:4604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-943.exe
        5⤵
        
        PID:15504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38409.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38409.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50416.exe
        5⤵
        
        PID:6200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27505.exe
        6⤵
        
        PID:8172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46100.exe
        6⤵
        
        PID:10880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57008.exe
        6⤵
        
        PID:16164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50940.exe
        5⤵
        
        PID:8348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37367.exe
        5⤵
        
        PID:11464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44458.exe
        5⤵
        
        PID:14496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3358.exe
        5⤵
        
        PID:1588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47601.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47601.exe
      4⤵
      PID:5404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50831.exe
        5⤵
        
        PID:7900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56810.exe
        5⤵
        
        PID:12108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57008.exe
        5⤵
        
        PID:16172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7185.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7185.exe
      4⤵
      PID:7540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9880.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9880.exe
      4⤵
      PID:10632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54587.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54587.exe
      4⤵
      PID:15168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41266.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41266.exe
      4⤵
      PID:5632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7127.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7127.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6655.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13549.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57317.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55945.exe
        7⤵
        
        PID:2772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24308.exe
        8⤵
        
        PID:5444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-999.exe
        9⤵
        
        PID:7248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12296.exe
        10⤵
        
        PID:9968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13932.exe
        10⤵
        
        PID:2336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10804.exe
        10⤵
        
        PID:15840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24651.exe
        9⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35321.exe
        9⤵
        
        PID:14168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39383.exe
        8⤵
        
        PID:7300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29356.exe
        8⤵
        
        PID:13128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32626.exe
        8⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30280.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15335.exe
        8⤵
        
        PID:7752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18159.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6914.exe
        8⤵
        
        PID:15736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18895.exe
        8⤵
        
        PID:7160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8729.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15493.exe
        7⤵
        
        PID:11440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47923.exe
        7⤵
        
        PID:1104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26446.exe
        6⤵
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9742.exe
        7⤵
        
        PID:6584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36450.exe
        8⤵
        
        PID:10440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60623.exe
        8⤵
        
        PID:14576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6344.exe
        7⤵
        
        PID:8416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11018.exe
        7⤵
        
        PID:14052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34828.exe
        7⤵
        
        PID:5364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10482.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7298.exe
        6⤵
        
        PID:10264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43035.exe
        6⤵
        
        PID:13352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50463.exe
        6⤵
        
        PID:2668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52759.exe
        5⤵
        
        PID:3168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59255.exe
        6⤵
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43115.exe
        7⤵
        
        PID:6724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49565.exe
        7⤵
        
        PID:11900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8004.exe
        7⤵
        
        PID:15852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15950.exe
        6⤵
        
        PID:7744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29356.exe
        6⤵
        
        PID:13264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24987.exe
        6⤵
        
        PID:3768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24043.exe
        5⤵
        
        PID:5304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61547.exe
        6⤵
        
        PID:8240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25196.exe
        6⤵
        
        PID:12488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47640.exe
        6⤵
        
        PID:3288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50319.exe
        5⤵
        
        PID:6328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14345.exe
        5⤵
        
        PID:11232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25912.exe
        5⤵
        
        PID:16136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19558.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19558.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62086.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18795.exe
        6⤵
        
        PID:2232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4973.exe
        7⤵
        
        PID:6228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57091.exe
        8⤵
        
        PID:10300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32099.exe
        8⤵
        
        PID:13440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4136.exe
        8⤵
        
        PID:16352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6344.exe
        7⤵
        
        PID:10224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26095.exe
        7⤵
        
        PID:12348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9684.exe
        6⤵
        
        PID:6220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4985.exe
        7⤵
        
        PID:13164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43524.exe
        7⤵
        
        PID:4248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18454.exe
        6⤵
        
        PID:10332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58719.exe
        6⤵
        
        PID:13808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-413.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25422.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27505.exe
        6⤵
        
        PID:7880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46100.exe
        6⤵
        
        PID:10460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35902.exe
        6⤵
        
        PID:9104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64354.exe
        5⤵
        
        PID:9056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5280.exe
        5⤵
        
        PID:11872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46083.exe
        5⤵
        
        PID:15212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36007.exe
        5⤵
        
        PID:844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19329.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19329.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18795.exe
        5⤵
        
        PID:2964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28491.exe
        6⤵
        
        PID:6364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11397.exe
        7⤵
        
        PID:9980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46287.exe
        7⤵
        
        PID:13968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10804.exe
        7⤵
        
        PID:920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40983.exe
        6⤵
        
        PID:9248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32369.exe
        6⤵
        
        PID:13880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39821.exe
        6⤵
        
        PID:16452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56313.exe
        5⤵
        
        PID:6800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56307.exe
        6⤵
        
        PID:5272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45835.exe
        6⤵
        
        PID:13456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40573.exe
        6⤵
        
        PID:6968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44252.exe
        5⤵
        
        PID:7004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32520.exe
        5⤵
        
        PID:14136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4882.exe
        5⤵
        
        PID:6676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31580.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31580.exe
      4⤵
      PID:5728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49378.exe
        5⤵
        
        PID:8232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47594.exe
        5⤵
        
        PID:10600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19893.exe
        5⤵
        
        PID:15932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26885.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26885.exe
      4⤵
      PID:7724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50450.exe
      4⤵
      PID:11416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22826.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22826.exe
      4⤵
      PID:6092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-525.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-525.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15204.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15204.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8289.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24073.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45705.exe
        7⤵
        
        PID:5412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51148.exe
        8⤵
        
        PID:8060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29356.exe
        8⤵
        
        PID:13280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57006.exe
        8⤵
        
        PID:15776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15176.exe
        7⤵
        
        PID:7276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10111.exe
        8⤵
        
        PID:10376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49508.exe
        8⤵
        
        PID:13544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57736.exe
        8⤵
        
        PID:15784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8077.exe
        7⤵
        
        PID:11168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14686.exe
        7⤵
        
        PID:14456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57006.exe
        7⤵
        
        PID:15172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59346.exe
        6⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50929.exe
        7⤵
        
        PID:6808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13573.exe
        8⤵
        
        PID:15392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44323.exe
        8⤵
        
        PID:4720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30182.exe
        7⤵
        
        PID:9284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26503.exe
        7⤵
        
        PID:13836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25088.exe
        7⤵
        
        PID:6984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3838.exe
        6⤵
        
        PID:6952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42255.exe
        7⤵
        
        PID:10044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18421.exe
        7⤵
        
        PID:8736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42621.exe
        7⤵
        
        PID:2852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19586.exe
        6⤵
        
        PID:10148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5271.exe
        6⤵
        
        PID:14216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40472.exe
        6⤵
        
        PID:16336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4046.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22498.exe
        6⤵
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6133.exe
        7⤵
        
        PID:9200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10269.exe
        7⤵
        
        PID:1600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58908.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33489.exe
        6⤵
        
        PID:2224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13525.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55581.exe
        6⤵
        
        PID:10964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33119.exe
        6⤵
        
        PID:3064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57006.exe
        6⤵
        
        PID:15848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43123.exe
        5⤵
        
        PID:1876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36495.exe
        6⤵
        
        PID:7292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57420.exe
        6⤵
        
        PID:10468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46585.exe
        6⤵
        
        PID:14516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41183.exe
        6⤵
        
        PID:15828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41523.exe
        6⤵
        
        PID:3436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33634.exe
        5⤵
        
        PID:8164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30229.exe
        5⤵
        
        PID:11972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32935.exe
        5⤵
        
        PID:1716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62939.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62939.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44130.exe
        5⤵
        
        PID:2924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50825.exe
        6⤵
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61416.exe
        7⤵
        
        PID:9552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36936.exe
        7⤵
        
        PID:11328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28559.exe
        7⤵
        
        PID:15940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57292.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54906.exe
        6⤵
        
        PID:11812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2866.exe
        6⤵
        
        PID:15980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4811.exe
        5⤵
        
        PID:2116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36495.exe
        6⤵
        
        PID:7256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63232.exe
        7⤵
        
        PID:11720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30587.exe
        7⤵
        
        PID:16084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59879.exe
        6⤵
        
        PID:11100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32147.exe
        6⤵
        
        PID:14412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48486.exe
        6⤵
        
        PID:15988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34162.exe
        5⤵
        
        PID:8280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44931.exe
        5⤵
        
        PID:12548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42303.exe
        5⤵
        
        PID:3008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56194.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56194.exe
      4⤵
      PID:1828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49253.exe
        5⤵
        
        PID:5140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50831.exe
        6⤵
        
        PID:7892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40556.exe
        6⤵
        
        PID:12072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8004.exe
        6⤵
        
        PID:4224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14033.exe
        5⤵
        
        PID:8180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54906.exe
        5⤵
        
        PID:11352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42053.exe
        5⤵
        
        PID:5616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29532.exe
      4⤵
      PID:6656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60812.exe
        5⤵
        
        PID:9936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49511.exe
        5⤵
        
        PID:12784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59808.exe
        5⤵
        
        PID:16140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50188.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50188.exe
      4⤵
      PID:8808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24847.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24847.exe
      4⤵
      PID:11752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3351.exe
      4⤵
      PID:14776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25049.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25049.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27883.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27883.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56180.exe
        5⤵
        
        PID:1120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9185.exe
        6⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32494.exe
        7⤵
        
        PID:7236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9221.exe
        8⤵
        
        PID:13516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46073.exe
        8⤵
        
        PID:16048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59879.exe
        7⤵
        
        PID:11176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8821.exe
        7⤵
        
        PID:14480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57008.exe
        7⤵
        
        PID:16156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51672.exe
        6⤵
        
        PID:7936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29356.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9931.exe
        5⤵
        
        PID:6496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27505.exe
        6⤵
        
        PID:8112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10598.exe
        6⤵
        
        PID:12044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35902.exe
        6⤵
        
        PID:9864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33662.exe
        5⤵
        
        PID:8856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33795.exe
        5⤵
        
        PID:11732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2821.exe
        5⤵
        
        PID:14492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45168.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45168.exe
      4⤵
      PID:1124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15329.exe
        5⤵
        
        PID:5880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53224.exe
        6⤵
        
        PID:6828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19945.exe
        6⤵
        
        PID:11296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18186.exe
        6⤵
        
        PID:15176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16669.exe
        6⤵
        
        PID:15860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51672.exe
        5⤵
        
        PID:7920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54906.exe
        5⤵
        
        PID:11788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55990.exe
        5⤵
        
        PID:6788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6520.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6520.exe
      4⤵
      PID:6288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27505.exe
        5⤵
        
        PID:7220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56810.exe
        5⤵
        
        PID:12124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48744.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48744.exe
      4⤵
      PID:8508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23712.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23712.exe
      4⤵
      PID:11584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26350.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26350.exe
      4⤵
      PID:14568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22673.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22673.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7140.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7140.exe
      4⤵
      PID:4728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6113.exe
        5⤵
        
        PID:5956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57320.exe
        6⤵
        
        PID:7380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23413.exe
        6⤵
        
        PID:10308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65142.exe
        6⤵
        
        PID:14524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58489.exe
        5⤵
        
        PID:9068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38927.exe
        6⤵
        
        PID:14860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8732.exe
        6⤵
        
        PID:4152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57692.exe
        5⤵
        
        PID:11860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62619.exe
        5⤵
        
        PID:1956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28625.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28625.exe
      4⤵
      PID:6164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49378.exe
        5⤵
        
        PID:7632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47594.exe
        5⤵
        
        PID:12272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19893.exe
        5⤵
        
        PID:15736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62585.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62585.exe
      4⤵
      PID:8316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44931.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44931.exe
      4⤵
      PID:12580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16952.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16952.exe
      4⤵
      PID:6960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24570.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24570.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9185.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9185.exe
      4⤵
      PID:6016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36367.exe
        5⤵
        
        PID:5428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41173.exe
        6⤵
        
        PID:15608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8267.exe
        5⤵
        
        PID:10584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35720.exe
        5⤵
        
        PID:14232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39502.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39502.exe
      4⤵
      PID:7912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29356.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29356.exe
      4⤵
      PID:13196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40091.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40091.exe
    3⤵
    PID:6176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43115.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43115.exe
      4⤵
      PID:5380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13462.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13462.exe
      4⤵
      PID:11664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8004.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8004.exe
      4⤵
      PID:1524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38784.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38784.exe
    3⤵
    PID:8308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2366.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2366.exe
    3⤵
    PID:11420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22322.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22322.exe
    3⤵
    PID:14556
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26455.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26455.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23921.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23921.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2166.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2166.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53367.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58341.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20840.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37620.exe
        8⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45528.exe
        9⤵
        
        PID:8120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29356.exe
        9⤵
        
        PID:13152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21915.exe
        9⤵
        
        PID:4612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15176.exe
        8⤵
        
        PID:7268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8077.exe
        8⤵
        
        PID:11200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14686.exe
        8⤵
        
        PID:14508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29387.exe
        7⤵
        
        PID:1336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43115.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49565.exe
        8⤵
        
        PID:12236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61450.exe
        8⤵
        
        PID:3468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9455.exe
        7⤵
        
        PID:7312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39546.exe
        7⤵
        
        PID:11304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30871.exe
        7⤵
        
        PID:15204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19425.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4207.exe
        6⤵
        Executes dropped EXE
        
        PID:5032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34548.exe
        7⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57996.exe
        8⤵
        
        PID:7056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23571.exe
        8⤵
        
        PID:11260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45681.exe
        8⤵
        
        PID:15116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58316.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46976.exe
        8⤵
        
        PID:10076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47460.exe
        8⤵
        
        PID:14016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10804.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44317.exe
        7⤵
        
        PID:10672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41585.exe
        7⤵
        
        PID:14164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1400.exe
        6⤵
        
        PID:556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27505.exe
        7⤵
        
        PID:8260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63847.exe
        7⤵
        
        PID:12448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48486.exe
        7⤵
        
        PID:16176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15320.exe
        6⤵
        
        PID:7404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30229.exe
        6⤵
        
        PID:11608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36007.exe
        6⤵
        
        PID:16144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53074.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46839.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20343.exe
        7⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51148.exe
        8⤵
        
        PID:8036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35706.exe
        9⤵
        
        PID:13696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24967.exe
        9⤵
        
        PID:6156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38653.exe
        8⤵
        
        PID:11600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22439.exe
        8⤵
        
        PID:112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57292.exe
        7⤵
        
        PID:7836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58377.exe
        8⤵
        
        PID:9560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12768.exe
        8⤵
        
        PID:13852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63680.exe
        8⤵
        
        PID:6248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29170.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3571.exe
        7⤵
        
        PID:13536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23614.exe
        7⤵
        
        PID:2724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57167.exe
        6⤵
        
        PID:5940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50831.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56810.exe
        7⤵
        
        PID:12100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19893.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12408.exe
        6⤵
        
        PID:7636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15493.exe
        6⤵
        
        PID:11408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35909.exe
        6⤵
        
        PID:5936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36462.exe
        5⤵
        
        PID:4028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37516.exe
        6⤵
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47875.exe
        7⤵
        
        PID:10152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28530.exe
        7⤵
        
        PID:12672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57968.exe
        6⤵
        
        PID:9960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27667.exe
        6⤵
        
        PID:12892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28559.exe
        6⤵
        
        PID:15880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53162.exe
        5⤵
        
        PID:6124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54278.exe
        6⤵
        
        PID:11992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64250.exe
        6⤵
        
        PID:15896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46985.exe
        5⤵
        
        PID:9952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5801.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60958.exe
        5⤵
        
        PID:6956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17736.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17736.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63052.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57993.exe
        6⤵
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19185.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23571.exe
        7⤵
        
        PID:10196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29023.exe
        7⤵
        
        PID:15020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33489.exe
        6⤵
        
        PID:6212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55581.exe
        6⤵
        
        PID:10956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33119.exe
        6⤵
        
        PID:13564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31907.exe
        6⤵
        
        PID:5172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25714.exe
        5⤵
        
        PID:5980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31848.exe
        6⤵
        
        PID:3296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6015.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21984.exe
        7⤵
        
        PID:14212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5320.exe
        6⤵
        
        PID:9652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38393.exe
        6⤵
        
        PID:13924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18520.exe
        5⤵
        
        PID:7016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47137.exe
        5⤵
        
        PID:10612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16384.exe
        5⤵
        
        PID:14280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11137.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11137.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58603.exe
        5⤵
        
        PID:3388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60386.exe
        6⤵
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51148.exe
        7⤵
        
        PID:8028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29356.exe
        7⤵
        
        PID:13192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44914.exe
        7⤵
        
        PID:3636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50517.exe
        6⤵
        
        PID:7532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11138.exe
        7⤵
        
        PID:11452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27408.exe
        6⤵
        
        PID:10892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2398.exe
        6⤵
        
        PID:14848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32517.exe
        6⤵
        
        PID:15812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65424.exe
        6⤵
        
        PID:6900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9931.exe
        5⤵
        
        PID:6500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28303.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36936.exe
        6⤵
        
        PID:11320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39807.exe
        5⤵
        
        PID:8668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13052.exe
        5⤵
        
        PID:11656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57642.exe
        5⤵
        
        PID:14912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23933.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23933.exe
      4⤵
      PID:5016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7530.exe
        5⤵
        
        PID:1268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45528.exe
        6⤵
        
        PID:8128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29356.exe
        6⤵
        
        PID:13212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57006.exe
        6⤵
        
        PID:1420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8532.exe
        5⤵
        
        PID:7980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29356.exe
        5⤵
        
        PID:13272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35501.exe
        5⤵
        
        PID:5228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57862.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57862.exe
      4⤵
      PID:6744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49378.exe
        5⤵
        
        PID:8008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47594.exe
        5⤵
        
        PID:560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8004.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14327.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14327.exe
      4⤵
      PID:8848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25660.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25660.exe
      4⤵
      PID:11724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47357.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47357.exe
      4⤵
      PID:14360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52327.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52327.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23171.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23171.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31080.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37513.exe
        6⤵
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24677.exe
        7⤵
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57320.exe
        8⤵
        
        PID:7344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27014.exe
        9⤵
        
        PID:13716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62606.exe
        9⤵
        
        PID:15756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28872.exe
        8⤵
        
        PID:11124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32147.exe
        8⤵
        
        PID:14428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20427.exe
        7⤵
        
        PID:8264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53596.exe
        7⤵
        
        PID:12556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38924.exe
        7⤵
        
        PID:6636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32328.exe
        6⤵
        
        PID:6576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54668.exe
        7⤵
        
        PID:7800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62820.exe
        7⤵
        
        PID:13796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10804.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49916.exe
        6⤵
        
        PID:8700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29306.exe
        6⤵
        
        PID:11672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57642.exe
        6⤵
        
        PID:15288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54857.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6372.exe
        6⤵
        
        PID:6344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-898.exe
        7⤵
        
        PID:12872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38179.exe
        7⤵
        
        PID:4376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29896.exe
        6⤵
        
        PID:10640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35720.exe
        6⤵
        
        PID:14276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40573.exe
        6⤵
        
        PID:6996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53238.exe
        5⤵
        
        PID:7904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10662.exe
        5⤵
        
        PID:11488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38981.exe
        5⤵
        
        PID:15956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14286.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14286.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36203.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55025.exe
        6⤵
        
        PID:6300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35340.exe
        7⤵
        
        PID:9708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36936.exe
        7⤵
        
        PID:11580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47640.exe
        7⤵
        
        PID:5636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59468.exe
        6⤵
        
        PID:10124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32156.exe
        6⤵
        
        PID:13184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44568.exe
        6⤵
        
        PID:16852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59736.exe
        5⤵
        
        PID:6524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1433.exe
        5⤵
        
        PID:10276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1449.exe
        5⤵
        
        PID:4600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25714.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25714.exe
      4⤵
      PID:5784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61547.exe
        5⤵
        
        PID:8288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25196.exe
        5⤵
        
        PID:12508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48486.exe
        5⤵
        
        PID:16008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35551.exe
      4⤵
      PID:7852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30880.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30880.exe
      4⤵
      PID:11336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43282.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43282.exe
      4⤵
      PID:15292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7419.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7419.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31080.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31080.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2017.exe
        5⤵
        
        PID:1796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57573.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63360.exe
        7⤵
        
        PID:10032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18421.exe
        7⤵
        
        PID:13288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10804.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25586.exe
        6⤵
        
        PID:10176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42266.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56981.exe
        6⤵
        
        PID:2992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62284.exe
        5⤵
        
        PID:6236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44431.exe
        6⤵
        
        PID:12544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21371.exe
        6⤵
        
        PID:3364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18454.exe
        5⤵
        
        PID:10316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58719.exe
        5⤵
        
        PID:13568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43047.exe
        5⤵
        
        PID:6152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11979.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11979.exe
      4⤵
      PID:5736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51148.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29356.exe
        5⤵
        
        PID:13168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19367.exe
        5⤵
        
        PID:2960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29685.exe
      4⤵
      PID:7768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46765.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46765.exe
      4⤵
      PID:11888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57538.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57538.exe
      4⤵
      PID:15640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33887.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33887.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44264.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44264.exe
      4⤵
      PID:2040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30821.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27505.exe
        6⤵
        
        PID:6280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47594.exe
        6⤵
        
        PID:12260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43510.exe
        6⤵
        
        PID:15484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57008.exe
        6⤵
        
        PID:16160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45897.exe
        5⤵
        
        PID:8224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31501.exe
        5⤵
        
        PID:11476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53123.exe
        5⤵
        
        PID:14752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58608.exe
      4⤵
      PID:6680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27505.exe
        5⤵
        
        PID:8096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47594.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8004.exe
        5⤵
        
        PID:15768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39283.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39283.exe
      4⤵
      PID:8756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20089.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20089.exe
      4⤵
      PID:11704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2821.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2821.exe
      4⤵
      PID:15352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37381.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37381.exe
    3⤵
    PID:5252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1779.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1779.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52331.exe
        5⤵
        
        PID:7080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25196.exe
        5⤵
        
        PID:12500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7639.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7639.exe
      4⤵
      PID:7972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61329.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61329.exe
      4⤵
      PID:12252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38770.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38770.exe
      4⤵
      PID:4428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-661.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-661.exe
    3⤵
    PID:5200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8200.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8200.exe
      4⤵
      PID:10924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10446.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10446.exe
      4⤵
      PID:13860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58517.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58517.exe
    3⤵
    PID:9660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26871.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26871.exe
    3⤵
    PID:11868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64819.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64819.exe
    3⤵
    PID:14952
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20862.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20862.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5079.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5079.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64485.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64485.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60276.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57993.exe
        6⤵
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2574.exe
        7⤵
        
        PID:7152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41097.exe
        8⤵
        
        PID:672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10804.exe
        8⤵
        
        PID:5096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32367.exe
        7⤵
        
        PID:10108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61195.exe
        7⤵
        
        PID:13996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50188.exe
        7⤵
        
        PID:15916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11211.exe
        6⤵
        
        PID:7136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25990.exe
        7⤵
        
        PID:14884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44525.exe
        7⤵
        
        PID:872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50586.exe
        6⤵
        
        PID:10884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65137.exe
        6⤵
        
        PID:13892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39389.exe
        5⤵
        
        PID:5676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51148.exe
        6⤵
        
        PID:8068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33680.exe
        6⤵
        
        PID:11208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24052.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60880.exe
        6⤵
        
        PID:7144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30209.exe
        5⤵
        
        PID:7668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36474.exe
        5⤵
        
        PID:10296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37539.exe
        5⤵
        
        PID:15256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49264.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49264.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57993.exe
        5⤵
        
        PID:5156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28300.exe
        6⤵
        
        PID:6184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18700.exe
        7⤵
        
        PID:3264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6344.exe
        6⤵
        
        PID:10212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26095.exe
        6⤵
        
        PID:11504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16669.exe
        6⤵
        
        PID:540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59736.exe
        5⤵
        
        PID:6384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56307.exe
        6⤵
        
        PID:9040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45835.exe
        6⤵
        
        PID:13448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45568.exe
        6⤵
        
        PID:1172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63088.exe
        5⤵
        
        PID:9256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41186.exe
        5⤵
        
        PID:12600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25714.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25714.exe
      4⤵
      PID:5716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27505.exe
        5⤵
        
        PID:8156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46100.exe
        5⤵
        
        PID:10732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35551.exe
      4⤵
      PID:7760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30229.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30229.exe
      4⤵
      PID:11712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14378.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14378.exe
      4⤵
      PID:9844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47639.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47639.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24073.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24073.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50416.exe
        5⤵
        
        PID:6192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30446.exe
        6⤵
        
        PID:9468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36936.exe
        6⤵
        
        PID:12368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35352.exe
        6⤵
        
        PID:5484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50940.exe
        5⤵
        
        PID:8340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44931.exe
        5⤵
        
        PID:12588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54990.exe
        5⤵
        
        PID:16040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18671.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18671.exe
      4⤵
      PID:6140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36495.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28872.exe
        5⤵
        
        PID:11136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32147.exe
        5⤵
        
        PID:14400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51712.exe
        5⤵
        
        PID:16240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13051.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13051.exe
      4⤵
      PID:8088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10662.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10662.exe
      4⤵
      PID:12676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26693.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26693.exe
      4⤵
      PID:5344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45437.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45437.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37620.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37620.exe
      4⤵
      PID:5392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10593.exe
        5⤵
        
        PID:3684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47372.exe
        6⤵
        
        PID:11360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48883.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21695.exe
        6⤵
        
        PID:15824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7916.exe
        5⤵
        
        PID:9992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32156.exe
        5⤵
        
        PID:13176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35352.exe
        5⤵
        
        PID:5456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15304.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15304.exe
      4⤵
      PID:6428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27515.exe
        5⤵
        
        PID:16300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35315.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35315.exe
      4⤵
      PID:9516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1449.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1449.exe
      4⤵
      PID:14296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64137.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64137.exe
    3⤵
    PID:5432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49378.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49378.exe
      4⤵
      PID:8020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47594.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47594.exe
      4⤵
      PID:840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63402.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63402.exe
      4⤵
      PID:16528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55657.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55657.exe
    3⤵
    PID:7372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31411.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31411.exe
    3⤵
    PID:10516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59922.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59922.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:15156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47681.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47681.exe
    3⤵
    PID:6664
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6390.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6390.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28386.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28386.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9974.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9974.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18795.exe
        5⤵
        
        PID:1060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39016.exe
        6⤵
        
        PID:6704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36457.exe
        7⤵
        
        PID:6824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1010.exe
        6⤵
        
        PID:9264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26503.exe
        6⤵
        
        PID:13872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62284.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45062.exe
        6⤵
        
        PID:12416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10804.exe
        6⤵
        
        PID:15364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18454.exe
        5⤵
        
        PID:10324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58719.exe
        5⤵
        
        PID:3640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60880.exe
        5⤵
        
        PID:1168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11979.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11979.exe
      4⤵
      PID:5744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50831.exe
        5⤵
        
        PID:7736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18159.exe
        5⤵
        
        PID:12008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35902.exe
        5⤵
        
        PID:16260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49637.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49637.exe
      4⤵
      PID:8972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28201.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28201.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46083.exe
      4⤵
      PID:15144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2300.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2300.exe
    3⤵
    PID:5288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18959.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18959.exe
      4⤵
      PID:5556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57091.exe
        5⤵
        
        PID:10340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39118.exe
        5⤵
        
        PID:14044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34707.exe
        5⤵
        
        PID:4964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31730.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31730.exe
      4⤵
      PID:10064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32156.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32156.exe
      4⤵
      PID:13144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34604.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34604.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11407.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11407.exe
    3⤵
    PID:10048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5801.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5801.exe
    3⤵
    PID:14224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28161.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28161.exe
    3⤵
    PID:16032
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26004.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26004.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19191.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19191.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49512.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49512.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45288.exe
        5⤵
        
        PID:5904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27505.exe
        6⤵
        
        PID:8140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10598.exe
        6⤵
        
        PID:12036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8004.exe
        6⤵
        
        PID:15672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58489.exe
        5⤵
        
        PID:9048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14469.exe
        5⤵
        
        PID:11904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22956.exe
        5⤵
        
        PID:14500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57967.exe
        5⤵
        
        PID:15784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40505.exe
        5⤵
        
        PID:6544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46558.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46558.exe
      4⤵
      PID:6432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17634.exe
        5⤵
        
        PID:9780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36936.exe
        5⤵
        
        PID:12688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-785.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51571.exe
      4⤵
      PID:8540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46083.exe
      4⤵
      PID:11612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42886.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42886.exe
      4⤵
      PID:15136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32721.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32721.exe
    3⤵
    PID:3968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13896.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13896.exe
      4⤵
      PID:6884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27505.exe
        5⤵
        
        PID:7040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47594.exe
        5⤵
        
        PID:11252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35902.exe
        5⤵
        
        PID:2892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37628.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37628.exe
      4⤵
      PID:9164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11480.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11480.exe
      4⤵
      PID:11956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40351.exe
      4⤵
      PID:16000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28310.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28310.exe
    3⤵
    PID:6312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4505.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4505.exe
      4⤵
      PID:10144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1449.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1449.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17249.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17249.exe
    3⤵
    PID:8524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23712.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23712.exe
    3⤵
    PID:11592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26350.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26350.exe
    3⤵
    PID:15216
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8847.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8847.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10102.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10102.exe
    3⤵
    PID:1824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60044.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60044.exe
      4⤵
      PID:7128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38659.exe
        5⤵
        
        PID:10100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18421.exe
        5⤵
        
        PID:13296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10804.exe
        5⤵
        
        PID:15720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47052.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47052.exe
      4⤵
      PID:9672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50672.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50672.exe
      4⤵
      PID:11484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57008.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57008.exe
      4⤵
      PID:16092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64755.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64755.exe
    3⤵
    PID:6456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45163.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45163.exe
      4⤵
      PID:9568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36936.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36936.exe
      4⤵
      PID:11292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59808.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59808.exe
      4⤵
      PID:15648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40983.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40983.exe
    3⤵
    PID:9240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42758.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42758.exe
    3⤵
    PID:13824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57008.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57008.exe
    3⤵
    PID:2440
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32054.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32054.exe
  2⤵
  PID:5816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29922.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29922.exe
    3⤵
    PID:9452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36936.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36936.exe
    3⤵
    PID:11456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1506.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1506.exe
    3⤵
    PID:16340
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39927.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39927.exe
  2⤵
  PID:7788
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4545.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4545.exe
  2⤵
  PID:10292
- C:\Users\Admin\AppData\Local\Temp\Unicorn-58788.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-58788.exe
  2⤵
  PID:15196
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21325.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21325.exe
  2⤵
  PID:7480

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:15552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-12278.exe

Filesize
468KB

MD5
c5eab194fbe1836858ddc1835e49f8c8

SHA1
c49bebd6a0d4a2764134ed91124a52ad8c7f370c

SHA256
fc57d44a142ef9cd75c6bc6b4d4590fce81c2ca2b763b9591e9b4385cc2cd28a

SHA512
bbc3c562e58bf679f712d778b7fb46c0777f4399b857ed9bf3abf3697d51b9179fb538f82db7e4d9c4d1a14d9f72a5d518f48c1655ac189cfd53edb196c99b90

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13549.exe

Filesize
468KB

MD5
d6ceb6f241b1b39eb2241a9978606c08

SHA1
5fa22ba5b90ef8ba8ba61786bf3928ba159fa20f

SHA256
7afa41c067c4e56041783e6a9b0a92f92a77764ca27bee776fc4173be72e1753

SHA512
b48ac88caf00711a43039a709ed8cbf0b322ae426d81284ffd7f43967a828231c0b6886274274f7e41d6862c725d988bff39ba89e3974c7f12b4bae6cc39dbea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15204.exe

Filesize
468KB

MD5
47f008562ccd0c19f994564a7fcf77ad

SHA1
a74291bde2b1d3600e848fd8eb4ebc6421e901a1

SHA256
3acfb2c1f78d745e787bc6ffc29ad86a5dbb82dfd9cc5a200483019d12117d30

SHA512
9b5f000637acfafe66e0d5a1f2fccfe4f6027df50cb497835a7d30d41c01b95250feea40e0740a876bb9f484e95af64070907e8d4490cb6513e8ff30a491e652

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17736.exe

Filesize
468KB

MD5
7236cdb48b7d94309a23f1050d2564be

SHA1
87f8d3a672bc27ad441a83d75d9294f911382085

SHA256
77e0c7597adbe9d7418d6d698331b3d4360b80b53834ca6b643d7f5743e8be3d

SHA512
dfafdb9aaf25ece562e1b4560ad8c91821d178948f0b7480936ae1cb76b5e3b289f43d66013e97a4adcd6c115ff4549c785b665a08e14258ec4d89919737aa17

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18814.exe

Filesize
468KB

MD5
ab59c388dfb8675f16823f9adecaea3e

SHA1
576c026241fe56db8753513b8dc4cb6bc4a5b8a1

SHA256
0195ca8bdb46b4c54fc97a3701fae0b69ed02fb9a55b23fbf98741aa7d18d6f0

SHA512
23aaa1486a38f3e3fd458c743ea0a3f3cd00e898b469ca519343c5c4c8bb9569552ff79fdb4a1b6eae779edf7350e35c60682567f0fd916a202c0b59b0b653cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19558.exe

Filesize
468KB

MD5
09b18ae7a9f25efaf230e0a685ceb930

SHA1
86c11dc98737572c2ccf377b914132674ec9129c

SHA256
8802342aabc462a00b65e5e78a19623248003667ea812f0a18eb2c8e49e2689d

SHA512
167869b35f4171379ffafd3f42b369d214e771936f227e7bdc2773932d66b5431acc35164504849350a03d44a68993be55811d4bca1bac457310208f7b880977

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20312.exe

Filesize
468KB

MD5
840dd64789345cf8886be070d1e9fe65

SHA1
528e3c691dbc7edc3b3b0bada88f537445f54199

SHA256
a8a5e632a6967297e7474264f259141a6abdd4539df36cb9c0c29d6c96068b07

SHA512
1168538815f12e608acef681f6afc62ba0ba26d0b8c4fd63ca55ed85c57d9226e13ce6ee323dc4a959c89de1e247f83d50a331cde9695f45f607e7e91843c72f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20862.exe

Filesize
468KB

MD5
c0e6639635ef2603f183dbfd1a4d4cc6

SHA1
f952bb57e9b3ac68e75fc66c91409457ea52c130

SHA256
cbad323764013520e7c96e926b7c1144b990ce929b2a324bcf16a366fa133c8f

SHA512
51e16480895297ca26579bdb4a01cbc61326ca09295be4c090d0bf16eccaad07d2f9a42bdcc142863c3fece6f0f4bc7686f3e70863ec902d04cee26cd46d343f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20995.exe

Filesize
468KB

MD5
682f92937a98ed4b38dd961c17d271c0

SHA1
0e3375447cc890979799ef664e96052960553f74

SHA256
8c167d1d3b3ad8cff4d2a2e1e6b40a7f8a252e8eac297997f39d63974e466342

SHA512
6f6546dfd0e20290ffa9a15a174c7066804f9e9a1cb1d1d6d1a4dee9553b3544b37d04c0feacbd5b6152efa5b4fac2d94e46ccaf2f1297b80f476386558d813a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2166.exe

Filesize
468KB

MD5
4468ee7b0f8eacc410fe97d60451959a

SHA1
e57b403b3189041e7f5ab7a008cb03a2169b9710

SHA256
d1936834f1f92782b8560ddb73fa3d6cf6793093a688d302494b3de0fc546793

SHA512
f982df6ce317749fcbcf4df8c55f0784e2b95246ca95f1db80f7d4cf965d9112adc5f70fa38b79e1076fc4eb7273de1153fcdd93cd4c242600ec977eeb1863c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23171.exe

Filesize
468KB

MD5
cde4cb740d030a0af7062fe6facd9ba5

SHA1
c4d58f1685c54923c3461c659225401cbd8923d8

SHA256
3797377e80c430e9046749238270272c9f0b0a329befc548674aa9ff2943ea21

SHA512
f0f95cdb772eacd72b82b13e39cb4c16f5bd9e9d5d335640dcda29f666f69eea4aba2112f1411debdabe7dcb4fe94bde2349e2310f6a9e15575df635f320729d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23921.exe

Filesize
468KB

MD5
8d2a3626d8a6baea61aa777831d3077d

SHA1
ada3b9151c0583abd0a4bd50533965616352f667

SHA256
60fa3298af9966894a304340c3f817dcfba48f7df592c02e68f740327d4f2a94

SHA512
d2dd650f34fd2f085d27ebb9aded6f7bc4276faf7e324b19c39b5ab694ab40b8f4c1acf72af165a46b55531eea492a352bf33680a3cad9293080735289522f0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25049.exe

Filesize
468KB

MD5
d13f79f9a0bb7f7a87861cc04055dc81

SHA1
0386168d1d8ab0f123497bf13be5f8226e82344f

SHA256
9eecdcbd32c840cc1390dfc17ddd1629d6fa6c7ed26a94b4d127e6a24fd5ff3d

SHA512
008fe8fe68ed2bcb4786705e1bed478b2fa0d6ad4a746f8286ff059fdc532e0bf7f376e25bb27663d99ea8bedad8cd1c1f4bc79e3852d471c0ce5e74625297ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26004.exe

Filesize
468KB

MD5
9afbb1267c62a7c7cd9b8f3ece5bef7f

SHA1
d34c49537022e1a354ddaf765610d626142f2b53

SHA256
3714d5c97f9acd732dcdaffcd695294da7f93304438bb7d437d2a7af0db34307

SHA512
b33f55685385213f92e06bc89b593540ce86c39c909236dea22928084e20647be0d834900ccfc61506565065be3965d5e1fe48b9baadac45a44b927e06fdb619

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26455.exe

Filesize
468KB

MD5
197d48771d460f164c2c75e11492303c

SHA1
8cdb47b47c5a54e55b364b7fb6458865d8360f44

SHA256
85acfeb0f25b1863c00a38503a58f54ae15dc02a86581541c21779e209977d1c

SHA512
53fd771494a8137255a6ac62300f943b1dbe8d441e3c91fa461e2e10e5fd6ae468e0effc410d5247d8fb9729dd804e0431c850d2896691f04c14b5c2c8fdb8e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28386.exe

Filesize
468KB

MD5
70f2f648f86ceae47a00330907563439

SHA1
041fc49702d3e20862425ea4da01443f3648ad39

SHA256
f90fd00c114f38117c7b9766406d41fb7c8a21cae4310f929328a74e5d04ac87

SHA512
a8644944d154f7622bb1e26d3934b48bb4436c6efc7dc16fc413c4bfeb49224d6c818f2ff0792c0e7ab0b7eed4c443591db473541f6e7e118645e4e191cfb170

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30065.exe

Filesize
468KB

MD5
bdbcb721f0e733447fab44a6b1828c6c

SHA1
b816212e2615079677e47d3c840c33488b4e5dff

SHA256
d001d9bf29f9d33c72295bfd67f921db8336018aa187f531d955ac754ef39827

SHA512
3734beb4d94f52a6c831f3d613670ccdc61e4b68147e9da49d00a654dfac78ae24b7ee6ab6ddc77c1a71488dfd4f7e543fb945e4cbf682c83343a3f52884385f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3305.exe

Filesize
468KB

MD5
3949dc59b0afb0f9f195a97d28ae4cd7

SHA1
f1d3c9b0aa91153e4948b344d4c78cf152594123

SHA256
341d861375016bbabe9e6028e3a000c04d03c9c235167c5e053ecf0a8636504b

SHA512
187d9411f7f5b953d4ddb2f4edd3e8291150ae30b4cd143141a054fc8089b19456f1e6c665d61b05753d588c54620f146c4c0540d3eb10b0ebebb6c42a31d0d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46196.exe

Filesize
468KB

MD5
01adf3616b0ddb3ac057b13eed6d4c57

SHA1
7c69046377dd9d9cd12c5ca6e0a98ccb15976f88

SHA256
d571c3f661d1908764a604e53b9b57e44051448defb3c2dbc9e1fcbe7e2d4e32

SHA512
fbf22ef70d7d92b343c5779856ea71f43700febac032c8c0edad265e73583fccce9d5a6c662aec12339f4cc3f32da8907a855a85250d11e37d891418fd4410cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47639.exe

Filesize
468KB

MD5
0c6ad6f146717bac2fb01317b3d08dfe

SHA1
393fe1edab4f1ab73954c27c95a87c45e5163b4b

SHA256
c2cc62be92b5ca4bc70a1916c7e4fdcda69ffb2cda46ff806590534a4bb72f4b

SHA512
9beb6ac373bae1ef07f39b24088aadd3591e9e2069ce5f36b712282cd618212f81fc53cefd65547b2659de5116b9a834900ca4f2089588e4df08310b7384e9bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5079.exe

Filesize
468KB

MD5
e1f3130ab2cac3b69023935a55ea7e8b

SHA1
2810d80861bdb978b68ed45073920dbbddc896e9

SHA256
345bb26bfddb16eb733f1b82cf14e28eac03d536c1f007bec84f44302abd450c

SHA512
08bb909fe9024aa15884554ebd37a75ab06abfd520b30da77964b9f06ffa30999a0f85196cab9844c35ed4719eed3faf8a91d629ba2911a528ab881249f3ea7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52327.exe

Filesize
468KB

MD5
f643f1c4f53a284b56303edc8534877d

SHA1
229443c3ee4060d0c12612666bcd0a7eaaf7ffa5

SHA256
db08eb68674a2156972f13e70f1ac9588c17904eeecec84942a337b3879fb959

SHA512
decf19fe401b496dfb4bc60a638a6b6f28cf105dff70d4ba0a5ee84dad9144f313f7e25ab2911122d3e382431ff9864f428d4b47008e131bd7b06a33cedd22d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-525.exe

Filesize
468KB

MD5
e0edcf4354f502c4d3a4c137d5adaa49

SHA1
d54e73f9bb3d39b51720f9805bcbefca6dfa3cd9

SHA256
792e950d8a14a4352d06710d9d28ef596377e701a98f3c26f3f647fd596d8e24

SHA512
6f38a38c6fa9618a3d395b8845ece5b58501057da4e2c415df5d1d42c93285b3ad543bae61989e8533e39b0d375bea3af46160155ca61e6e9ea9c7780004371c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53367.exe

Filesize
468KB

MD5
0405258c72d5134d1c02d8fd7123c8ba

SHA1
5c5c5acd27e01bec59e80cd63bd225a7c6cf18f9

SHA256
7d2bd760ce82e6c26189279b3152ad246dd91b8c8c3cb8b44a8d9b38e7fc9783

SHA512
63bfdc46f4e1e2539e39c688840cc8b5b8af0b36174225707eb6a8bb66870168f40ea94343ca790c6d2de9a4887b7ec1c27d2995a596477978e4d6799a772a65

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58341.exe

Filesize
468KB

MD5
a59700e29fefb8076a9f94d9dd442391

SHA1
a681349a37cf2eb691f447d7f95a71998fd4dc52

SHA256
fd134bdc56691bb5a081f4ea9d87c7b0e169013e15492f9d4e4d1115e0b483bb

SHA512
623917a9e3f8888dbac1f739041770533529a3c51721a2ca68e92e9754bbec788bdf2c49c5b2dcd03847dad2dfc34cb8a5f6210b6f6f13d841f6024c107597e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6390.exe

Filesize
468KB

MD5
adfb26bf98fdab4094759dcf4868995f

SHA1
fb22bfcac514ce6e9b1b91df7ff247665b1bc354

SHA256
5bc5a5bd237cf364b4a9f49dc1169db0e302ab4903dea2b5e97e122cb69d0f3a

SHA512
9ea81f75cb0cba186ad269ea4e37739bb98a767dc2c6e30f2d60cb33c386ada030a48026c22200f2d81877829d3c97f59d8623dafb75d040d91c7c511db57495

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64485.exe

Filesize
468KB

MD5
c00dca7e53c98ca00cc6d878396c8e8f

SHA1
b216145a2dff053726f9011ce4a7fe823b2b918a

SHA256
c7a9eccbe1a3685b9a9b242fd1ea84c530604c7ecea5a2df19f9b623c0572e7a

SHA512
196251ce4d6c3b9998936582492d4297edbb6b30483d64e09fd427875afea53c8682f75a1cff72d5ae6044b0aa31819d063318e389bee9e5190df6ed11de43a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6655.exe

Filesize
468KB

MD5
5cb03757b26387c467e21f526294d9aa

SHA1
98e2cf5ad576cffa74a09142a39ad6b8d0a4a3fd

SHA256
179804bf527c7f608fdcbce4a7181004776900c0d93a8645fecf0ecc7875384d

SHA512
d8fe970c7e84e50ee41517189dbdb9584abef2a6e2e7c44eb10062d544ff13343853a1881c0c0ac6fdfd38396a1800095198f0e166c29a4ad78647cc3cc561df

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7127.exe

Filesize
468KB

MD5
18f5e210d36b175320df21264f246c06

SHA1
82dabffb7cce7353d3b8360f846f9c94b3a4f439

SHA256
13ac499333676d18a3c738b8e8c1dea3bf019291debf3c822abc33e7295a6b08

SHA512
e878505fc56b9263864559a1e650cdb3a519e98b9bb5a32c425eef916cee7d5a89ad2e6547cb7c3c70e88f8918507b207f8b8a9914f8cc3ced51237dd838ab1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7419.exe

Filesize
468KB

MD5
556afac0381a52199da06d5524173d2e

SHA1
9cbfdbf4961701939201e75382f5636cc13529ed

SHA256
6c64c8a12d26b589cbf63cd2bbb99858a2a59cf039f4b7405e923140ebea0cdf

SHA512
77197f48efe3372eb1a67b4ad2506e714a1db2cf80e1b2e52d98837e39219d2e60cdcd4b2f30b615dd9ae9ceac08e010e76230389fc71fe8f2aba3929939089e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9861.exe

Filesize
468KB

MD5
33f94044fefcba32c302393670d8a86e

SHA1
920448299abe559230cd8b1ddee07874509d2550

SHA256
fb7c58045f73b8be6f6d007aeca7bcc932b667c7286f308c3148b1a4d397763f

SHA512
beb3bc8d25279e27780ccc7a66b88c48800c3eca759a1b53bf0deec9c5cc2055a475d5b3eecfe3547353cde16e81093b7e2754a3712195c62941b0cf712d39cf

Download Submit
memory/316-294-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/436-133-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/516-160-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/708-372-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/736-365-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/772-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/952-120-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1120-418-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1124-413-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1128-55-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1164-33-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1356-148-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1400-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1500-284-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1560-242-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1796-489-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1824-487-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1828-407-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1868-297-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1924-84-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1936-172-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2012-43-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2040-461-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2160-239-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2168-361-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2192-41-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2228-363-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2276-103-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2600-199-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2632-271-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2772-455-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2796-135-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2872-193-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2888-144-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2908-14-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2924-400-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3048-236-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3068-117-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3076-270-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3136-209-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3156-302-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3168-419-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3232-247-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3328-379-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3332-179-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3372-296-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3388-399-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3524-293-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3600-380-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3644-219-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3676-173-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3712-291-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3780-107-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3792-460-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3968-453-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3988-495-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4028-517-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4056-488-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4064-268-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4084-454-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4104-360-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4236-392-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4344-376-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4352-494-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4360-486-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4452-420-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4616-403-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4620-83-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4696-311-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4728-414-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4804-373-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4812-415-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4832-295-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4860-252-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4868-60-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4920-178-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4940-225-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4944-370-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4948-20-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4960-86-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4980-85-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4988-7-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5016-406-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5032-394-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5036-224-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5084-292-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5148-507-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5176-515-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5252-531-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5264-526-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5288-547-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5384-532-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5412-539-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5472-549-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5492-548-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5648-617-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads