f4db5ac3731d85ca264cc53e0e4260c16b57400491bfa61f50c6a36142e50465

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21/11/2024, 12:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f4db5ac3731d85ca264cc53e0e4260c16b57400491bfa61f50c6a36142e50465.exe
Size 468KB
Sample241121-pn9pmaskhs
SHA256 f4db5ac3731d85ca264cc53e0e4260c16b57400491bfa61f50c6a36142e50465
MD5 3576c4f01432f744151bf131603bb116
SHA1 eaaae8a00be23db2f10e42ce52cedd27657fd78c
SHA512 cd5008717b20626f4e3047578ea20fa3045723e0262421648d1de2fb1c4376185555ffad2835cbf1513e0a01c445d9eaad15db2df57d2c29520ff8c9b3880adc
SSDEEP 3072:lqPEogTKjy822bY9PzsvqfU/Ekhjj+plPmHXLVIsdQLGZb7NV9le:lqMoXL22+Povqf0uOXdQyV7NV
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2772	Unicorn-49560.exe
1712	Unicorn-8563.exe
2144	Unicorn-32513.exe
2968	Unicorn-31478.exe
2660	Unicorn-28463.exe
2760	Unicorn-21124.exe
1160	Unicorn-26691.exe
2588	Unicorn-54155.exe
2596	Unicorn-52256.exe
1764	Unicorn-28520.exe
1656	Unicorn-61939.exe
2532	Unicorn-16268.exe
1464	Unicorn-26473.exe
3036	Unicorn-32604.exe
2920	Unicorn-32339.exe
3040	Unicorn-65105.exe
3044	Unicorn-42447.exe
1592	Unicorn-28711.exe
712	Unicorn-48577.exe
1548	Unicorn-49537.exe
1104	Unicorn-11227.exe
1152	Unicorn-13273.exe
1284	Unicorn-62837.exe
900	Unicorn-20984.exe
1828	Unicorn-17166.exe
2960	Unicorn-26486.exe
1620	Unicorn-6620.exe
1876	Unicorn-17166.exe
316	Unicorn-6620.exe
2348	Unicorn-26486.exe
2460	Unicorn-17555.exe
2672	Unicorn-15001.exe
2828	Unicorn-29837.exe
2768	Unicorn-33367.exe
2680	Unicorn-50066.exe
2576	Unicorn-4394.exe
2664	Unicorn-4202.exe
2076	Unicorn-33175.exe
1064	Unicorn-32910.exe
2852	Unicorn-63609.exe
1268	Unicorn-58042.exe
2756	Unicorn-12370.exe
2880	Unicorn-28442.exe
2892	Unicorn-25391.exe
2208	Unicorn-2785.exe
1036	Unicorn-18567.exe
1144	Unicorn-62322.exe
2528	Unicorn-2915.exe
688	Unicorn-30734.exe
1992	Unicorn-24082.exe
2120	Unicorn-43948.exe
3012	Unicorn-10891.exe
916	Unicorn-56008.exe
2184	Unicorn-7362.exe
2636	Unicorn-21097.exe
2684	Unicorn-45463.exe
2260	Unicorn-65328.exe
2080	Unicorn-65328.exe
2620	Unicorn-60098.exe
3056	Unicorn-61415.exe
3048	Unicorn-43594.exe
1684	Unicorn-29112.exe
1432	Unicorn-64699.exe
1648	Unicorn-49340.exe

Loads dropped DLL 64 IoCs

pid	Process
388	f4db5ac3731d85ca264cc53e0e4260c16b57400491bfa61f50c6a36142e50465.exe
388	f4db5ac3731d85ca264cc53e0e4260c16b57400491bfa61f50c6a36142e50465.exe
388	f4db5ac3731d85ca264cc53e0e4260c16b57400491bfa61f50c6a36142e50465.exe
2772	Unicorn-49560.exe
388	f4db5ac3731d85ca264cc53e0e4260c16b57400491bfa61f50c6a36142e50465.exe
2772	Unicorn-49560.exe
2144	Unicorn-32513.exe
2144	Unicorn-32513.exe
2772	Unicorn-49560.exe
1712	Unicorn-8563.exe
1712	Unicorn-8563.exe
2772	Unicorn-49560.exe
388	f4db5ac3731d85ca264cc53e0e4260c16b57400491bfa61f50c6a36142e50465.exe
388	f4db5ac3731d85ca264cc53e0e4260c16b57400491bfa61f50c6a36142e50465.exe
2968	Unicorn-31478.exe
2144	Unicorn-32513.exe
2968	Unicorn-31478.exe
2144	Unicorn-32513.exe
2660	Unicorn-28463.exe
2660	Unicorn-28463.exe
1712	Unicorn-8563.exe
1712	Unicorn-8563.exe
2760	Unicorn-21124.exe
2760	Unicorn-21124.exe
2772	Unicorn-49560.exe
2772	Unicorn-49560.exe
1160	Unicorn-26691.exe
1160	Unicorn-26691.exe
388	f4db5ac3731d85ca264cc53e0e4260c16b57400491bfa61f50c6a36142e50465.exe
388	f4db5ac3731d85ca264cc53e0e4260c16b57400491bfa61f50c6a36142e50465.exe
2588	Unicorn-54155.exe
2588	Unicorn-54155.exe
2144	Unicorn-32513.exe
2144	Unicorn-32513.exe
2596	Unicorn-52256.exe
2968	Unicorn-31478.exe
2968	Unicorn-31478.exe
2596	Unicorn-52256.exe
1656	Unicorn-61939.exe
1656	Unicorn-61939.exe
1712	Unicorn-8563.exe
1712	Unicorn-8563.exe
1764	Unicorn-28520.exe
1764	Unicorn-28520.exe
2660	Unicorn-28463.exe
2660	Unicorn-28463.exe
2772	Unicorn-49560.exe
2772	Unicorn-49560.exe
3036	Unicorn-32604.exe
1464	Unicorn-26473.exe
3036	Unicorn-32604.exe
1464	Unicorn-26473.exe
1160	Unicorn-26691.exe
2532	Unicorn-16268.exe
2920	Unicorn-32339.exe
2920	Unicorn-32339.exe
2532	Unicorn-16268.exe
1160	Unicorn-26691.exe
2760	Unicorn-21124.exe
2760	Unicorn-21124.exe
388	f4db5ac3731d85ca264cc53e0e4260c16b57400491bfa61f50c6a36142e50465.exe
388	f4db5ac3731d85ca264cc53e0e4260c16b57400491bfa61f50c6a36142e50465.exe
3040	Unicorn-65105.exe
3040	Unicorn-65105.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1312	1684	WerFault.exe	93
6560	1604	WerFault.exe	132

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59203.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53761.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57449.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11247.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45145.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12620.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26926.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4601.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26489.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57845.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24113.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55292.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53603.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27059.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27482.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14618.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43595.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31036.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13266.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49537.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57206.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18350.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50174.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61266.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32540.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38573.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4394.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59179.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43470.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9419.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7401.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7401.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15907.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13970.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12370.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52983.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35286.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21124.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16268.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54403.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11707.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19063.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45329.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9274.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25930.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37225.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60469.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41082.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42447.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6620.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6620.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11862.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19302.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22168.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53603.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43595.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21507.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56029.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10890.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13266.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60645.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32659.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51848.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40264.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
388	f4db5ac3731d85ca264cc53e0e4260c16b57400491bfa61f50c6a36142e50465.exe
2772	Unicorn-49560.exe
2144	Unicorn-32513.exe
1712	Unicorn-8563.exe
2968	Unicorn-31478.exe
2660	Unicorn-28463.exe
2760	Unicorn-21124.exe
1160	Unicorn-26691.exe
2588	Unicorn-54155.exe
2596	Unicorn-52256.exe
1764	Unicorn-28520.exe
1656	Unicorn-61939.exe
2532	Unicorn-16268.exe
1464	Unicorn-26473.exe
3036	Unicorn-32604.exe
2920	Unicorn-32339.exe
3040	Unicorn-65105.exe
1592	Unicorn-28711.exe
712	Unicorn-48577.exe
3044	Unicorn-42447.exe
1548	Unicorn-49537.exe
1104	Unicorn-11227.exe
1828	Unicorn-17166.exe
1152	Unicorn-13273.exe
1284	Unicorn-62837.exe
316	Unicorn-6620.exe
1876	Unicorn-17166.exe
1620	Unicorn-6620.exe
2460	Unicorn-17555.exe
2348	Unicorn-26486.exe
900	Unicorn-20984.exe
2672	Unicorn-15001.exe
2768	Unicorn-33367.exe
2828	Unicorn-29837.exe
2680	Unicorn-50066.exe
2576	Unicorn-4394.exe
2076	Unicorn-33175.exe
1064	Unicorn-32910.exe
2664	Unicorn-4202.exe
2852	Unicorn-63609.exe
1268	Unicorn-58042.exe
2756	Unicorn-12370.exe
2880	Unicorn-28442.exe
2892	Unicorn-25391.exe
2208	Unicorn-2785.exe
1036	Unicorn-18567.exe
1144	Unicorn-62322.exe
2528	Unicorn-2915.exe
1748	Unicorn-64368.exe
688	Unicorn-30734.exe
1992	Unicorn-24082.exe
2120	Unicorn-43948.exe
3012	Unicorn-10891.exe
2184	Unicorn-7362.exe
916	Unicorn-56008.exe
2636	Unicorn-21097.exe
2260	Unicorn-65328.exe
2684	Unicorn-45463.exe
2080	Unicorn-65328.exe
2620	Unicorn-60098.exe
3056	Unicorn-61415.exe
3048	Unicorn-43594.exe
1684	Unicorn-29112.exe
1432	Unicorn-64699.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 388 wrote to memory of 2772	388	f4db5ac3731d85ca264cc53e0e4260c16b57400491bfa61f50c6a36142e50465.exe	31
PID 388 wrote to memory of 2772	388	f4db5ac3731d85ca264cc53e0e4260c16b57400491bfa61f50c6a36142e50465.exe	31
PID 388 wrote to memory of 2772	388	f4db5ac3731d85ca264cc53e0e4260c16b57400491bfa61f50c6a36142e50465.exe	31
PID 388 wrote to memory of 2772	388	f4db5ac3731d85ca264cc53e0e4260c16b57400491bfa61f50c6a36142e50465.exe	31
PID 388 wrote to memory of 1712	388	f4db5ac3731d85ca264cc53e0e4260c16b57400491bfa61f50c6a36142e50465.exe	32
PID 388 wrote to memory of 1712	388	f4db5ac3731d85ca264cc53e0e4260c16b57400491bfa61f50c6a36142e50465.exe	32
PID 388 wrote to memory of 1712	388	f4db5ac3731d85ca264cc53e0e4260c16b57400491bfa61f50c6a36142e50465.exe	32
PID 388 wrote to memory of 1712	388	f4db5ac3731d85ca264cc53e0e4260c16b57400491bfa61f50c6a36142e50465.exe	32
PID 2772 wrote to memory of 2144	2772	Unicorn-49560.exe	33
PID 2772 wrote to memory of 2144	2772	Unicorn-49560.exe	33
PID 2772 wrote to memory of 2144	2772	Unicorn-49560.exe	33
PID 2772 wrote to memory of 2144	2772	Unicorn-49560.exe	33
PID 2144 wrote to memory of 2968	2144	Unicorn-32513.exe	34
PID 2144 wrote to memory of 2968	2144	Unicorn-32513.exe	34
PID 2144 wrote to memory of 2968	2144	Unicorn-32513.exe	34
PID 2144 wrote to memory of 2968	2144	Unicorn-32513.exe	34
PID 2772 wrote to memory of 2760	2772	Unicorn-49560.exe	36
PID 2772 wrote to memory of 2760	2772	Unicorn-49560.exe	36
PID 2772 wrote to memory of 2760	2772	Unicorn-49560.exe	36
PID 2772 wrote to memory of 2760	2772	Unicorn-49560.exe	36
PID 1712 wrote to memory of 2660	1712	Unicorn-8563.exe	35
PID 1712 wrote to memory of 2660	1712	Unicorn-8563.exe	35
PID 1712 wrote to memory of 2660	1712	Unicorn-8563.exe	35
PID 1712 wrote to memory of 2660	1712	Unicorn-8563.exe	35
PID 388 wrote to memory of 1160	388	f4db5ac3731d85ca264cc53e0e4260c16b57400491bfa61f50c6a36142e50465.exe	37
PID 388 wrote to memory of 1160	388	f4db5ac3731d85ca264cc53e0e4260c16b57400491bfa61f50c6a36142e50465.exe	37
PID 388 wrote to memory of 1160	388	f4db5ac3731d85ca264cc53e0e4260c16b57400491bfa61f50c6a36142e50465.exe	37
PID 388 wrote to memory of 1160	388	f4db5ac3731d85ca264cc53e0e4260c16b57400491bfa61f50c6a36142e50465.exe	37
PID 2968 wrote to memory of 2596	2968	Unicorn-31478.exe	38
PID 2968 wrote to memory of 2596	2968	Unicorn-31478.exe	38
PID 2968 wrote to memory of 2596	2968	Unicorn-31478.exe	38
PID 2968 wrote to memory of 2596	2968	Unicorn-31478.exe	38
PID 2144 wrote to memory of 2588	2144	Unicorn-32513.exe	39
PID 2144 wrote to memory of 2588	2144	Unicorn-32513.exe	39
PID 2144 wrote to memory of 2588	2144	Unicorn-32513.exe	39
PID 2144 wrote to memory of 2588	2144	Unicorn-32513.exe	39
PID 2660 wrote to memory of 1764	2660	Unicorn-28463.exe	40
PID 2660 wrote to memory of 1764	2660	Unicorn-28463.exe	40
PID 2660 wrote to memory of 1764	2660	Unicorn-28463.exe	40
PID 2660 wrote to memory of 1764	2660	Unicorn-28463.exe	40
PID 1712 wrote to memory of 1656	1712	Unicorn-8563.exe	41
PID 1712 wrote to memory of 1656	1712	Unicorn-8563.exe	41
PID 1712 wrote to memory of 1656	1712	Unicorn-8563.exe	41
PID 1712 wrote to memory of 1656	1712	Unicorn-8563.exe	41
PID 2760 wrote to memory of 2532	2760	Unicorn-21124.exe	42
PID 2760 wrote to memory of 2532	2760	Unicorn-21124.exe	42
PID 2760 wrote to memory of 2532	2760	Unicorn-21124.exe	42
PID 2760 wrote to memory of 2532	2760	Unicorn-21124.exe	42
PID 2772 wrote to memory of 1464	2772	Unicorn-49560.exe	43
PID 2772 wrote to memory of 1464	2772	Unicorn-49560.exe	43
PID 2772 wrote to memory of 1464	2772	Unicorn-49560.exe	43
PID 2772 wrote to memory of 1464	2772	Unicorn-49560.exe	43
PID 1160 wrote to memory of 3036	1160	Unicorn-26691.exe	44
PID 1160 wrote to memory of 3036	1160	Unicorn-26691.exe	44
PID 1160 wrote to memory of 3036	1160	Unicorn-26691.exe	44
PID 1160 wrote to memory of 3036	1160	Unicorn-26691.exe	44
PID 388 wrote to memory of 2920	388	f4db5ac3731d85ca264cc53e0e4260c16b57400491bfa61f50c6a36142e50465.exe	45
PID 388 wrote to memory of 2920	388	f4db5ac3731d85ca264cc53e0e4260c16b57400491bfa61f50c6a36142e50465.exe	45
PID 388 wrote to memory of 2920	388	f4db5ac3731d85ca264cc53e0e4260c16b57400491bfa61f50c6a36142e50465.exe	45
PID 388 wrote to memory of 2920	388	f4db5ac3731d85ca264cc53e0e4260c16b57400491bfa61f50c6a36142e50465.exe	45
PID 2588 wrote to memory of 3040	2588	Unicorn-54155.exe	46
PID 2588 wrote to memory of 3040	2588	Unicorn-54155.exe	46
PID 2588 wrote to memory of 3040	2588	Unicorn-54155.exe	46
PID 2588 wrote to memory of 3040	2588	Unicorn-54155.exe	46

C:\Users\Admin\AppData\Local\Temp\f4db5ac3731d85ca264cc53e0e4260c16b57400491bfa61f50c6a36142e50465.exe
"C:\Users\Admin\AppData\Local\Temp\f4db5ac3731d85ca264cc53e0e4260c16b57400491bfa61f50c6a36142e50465.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:388
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49560.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49560.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32513.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32513.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31478.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31478.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52256.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48577.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33367.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56029.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11862.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28779.exe
        9⤵
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        9⤵
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46090.exe
        9⤵
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8447.exe
        9⤵
        
        PID:6712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13970.exe
        9⤵
        
        PID:6992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57534.exe
        8⤵
        
        PID:3112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42515.exe
        8⤵
        
        PID:4044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13266.exe
        8⤵
        
        PID:4420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45593.exe
        8⤵
        
        PID:2816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57449.exe
        8⤵
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37875.exe
        8⤵
        
        PID:7536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21664.exe
        7⤵
        
        PID:2044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14374.exe
        8⤵
        
        PID:1304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51269.exe
        8⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48051.exe
        8⤵
        
        PID:6952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13358.exe
        8⤵
        
        PID:6572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23386.exe
        7⤵
        
        PID:3620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13266.exe
        7⤵
        
        PID:4388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27059.exe
        7⤵
        
        PID:2764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38573.exe
        7⤵
        
        PID:6352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9505.exe
        7⤵
        
        PID:6488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50066.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29112.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1684
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 220
        8⤵
        Program crash
        
        PID:1312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2002.exe
        7⤵
        
        PID:3252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4601.exe
        7⤵
        
        PID:1404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29202.exe
        7⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17042.exe
        7⤵
        
        PID:6864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4170.exe
        7⤵
        
        PID:7156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64699.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10523.exe
        7⤵
        
        PID:2384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43470.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        7⤵
        
        PID:4644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54403.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8447.exe
        7⤵
        
        PID:6744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59406.exe
        7⤵
        
        PID:7648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1706.exe
        6⤵
        
        PID:408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54406.exe
        6⤵
        
        PID:3500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53603.exe
        6⤵
        
        PID:4564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42039.exe
        6⤵
        
        PID:5728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11707.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64670.exe
        6⤵
        
        PID:7388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28711.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33175.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62469.exe
        7⤵
        
        PID:328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4446.exe
        8⤵
        
        PID:2848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39578.exe
        8⤵
        
        PID:3984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45991.exe
        8⤵
        
        PID:5204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43595.exe
        8⤵
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22594.exe
        8⤵
        
        PID:7148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13755.exe
        8⤵
        
        PID:7892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11462.exe
        7⤵
        
        PID:1692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57206.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13266.exe
        7⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32416.exe
        7⤵
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38573.exe
        7⤵
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28617.exe
        7⤵
        
        PID:6280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6999.exe
        6⤵
        
        PID:1872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49371.exe
        7⤵
        
        PID:3052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50871.exe
        7⤵
        
        PID:3856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        7⤵
        
        PID:4748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41082.exe
        7⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61732.exe
        7⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53695.exe
        7⤵
        
        PID:6592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63853.exe
        6⤵
        
        PID:2796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59179.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4601.exe
        6⤵
        
        PID:4320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29202.exe
        6⤵
        
        PID:5856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17042.exe
        6⤵
        
        PID:6788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4170.exe
        6⤵
        
        PID:6908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63609.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32843.exe
        6⤵
        
        PID:1604
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 200
        7⤵
        Program crash
        
        PID:6560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5567.exe
        6⤵
        
        PID:3712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        6⤵
        
        PID:4668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41082.exe
        6⤵
        
        PID:5928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8447.exe
        6⤵
        
        PID:6736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4733.exe
        6⤵
        
        PID:7560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56698.exe
        5⤵
        
        PID:2800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9651.exe
        6⤵
        
        PID:3688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        6⤵
        
        PID:4232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41082.exe
        6⤵
        
        PID:5920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8447.exe
        6⤵
        
        PID:6648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26926.exe
        6⤵
        
        PID:7300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2932.exe
        5⤵
        
        PID:3092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23179.exe
        5⤵
        
        PID:3944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5131.exe
        5⤵
        
        PID:4740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16424.exe
        5⤵
        
        PID:5668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15907.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46171.exe
        5⤵
        
        PID:6496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54155.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54155.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65105.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:3040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15001.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27441.exe
        7⤵
        
        PID:596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9651.exe
        8⤵
        
        PID:3704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        8⤵
        
        PID:4224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41082.exe
        8⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8447.exe
        8⤵
        
        PID:6632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13970.exe
        8⤵
        
        PID:6516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57534.exe
        7⤵
        
        PID:3148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42515.exe
        7⤵
        
        PID:4056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13266.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53761.exe
        7⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57449.exe
        7⤵
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21798.exe
        7⤵
        
        PID:7444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64752.exe
        6⤵
        
        PID:1668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20612.exe
        7⤵
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18966.exe
        7⤵
        
        PID:3440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        7⤵
        
        PID:4264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41082.exe
        7⤵
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8447.exe
        7⤵
        
        PID:6720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49849.exe
        7⤵
        
        PID:7348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10890.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9419.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53603.exe
        6⤵
        
        PID:4652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46268.exe
        6⤵
        
        PID:5864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22594.exe
        6⤵
        
        PID:5692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11707.exe
        6⤵
        
        PID:6356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8370.exe
        6⤵
        
        PID:6576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29837.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37311.exe
        6⤵
        
        PID:2572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1418.exe
        7⤵
        
        PID:7808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47939.exe
        6⤵
        
        PID:2916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        6⤵
        
        PID:2312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41082.exe
        6⤵
        
        PID:5936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8447.exe
        6⤵
        
        PID:6672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13970.exe
        6⤵
        
        PID:6880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14844.exe
        5⤵
        
        PID:1836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4687.exe
        6⤵
        
        PID:6500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-850.exe
        5⤵
        
        PID:3864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4601.exe
        5⤵
        
        PID:4208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44125.exe
        5⤵
        
        PID:5224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37638.exe
        5⤵
        
        PID:7056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12620.exe
        5⤵
        
        PID:7908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42447.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42447.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4394.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49340.exe
        6⤵
        Executes dropped EXE
        
        PID:1648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30617.exe
        7⤵
        
        PID:2284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18966.exe
        7⤵
        
        PID:3428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        7⤵
        
        PID:3412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43595.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21507.exe
        7⤵
        
        PID:6548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5395.exe
        7⤵
        
        PID:7436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55292.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32701.exe
        6⤵
        
        PID:3476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13266.exe
        6⤵
        
        PID:4436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53761.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57449.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31036.exe
        6⤵
        
        PID:6484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21306.exe
        5⤵
        
        PID:1256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11862.exe
        6⤵
        
        PID:3268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28779.exe
        6⤵
        
        PID:4080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        6⤵
        
        PID:4540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43595.exe
        6⤵
        
        PID:5444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21507.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62572.exe
        6⤵
        
        PID:7748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29252.exe
        5⤵
        
        PID:3644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4601.exe
        5⤵
        
        PID:3404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44763.exe
        5⤵
        
        PID:5676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37254.exe
        5⤵
        
        PID:7000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12620.exe
        5⤵
        
        PID:7948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32910.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32910.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63237.exe
        5⤵
        
        PID:2196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14467.exe
        6⤵
        
        PID:3520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42915.exe
        6⤵
        
        PID:3996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        6⤵
        
        PID:4508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43595.exe
        6⤵
        
        PID:5476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21507.exe
        6⤵
        
        PID:6600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37875.exe
        6⤵
        
        PID:7620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40621.exe
        5⤵
        
        PID:3360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47559.exe
        5⤵
        
        PID:3352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13266.exe
        5⤵
        
        PID:4168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-757.exe
        5⤵
        
        PID:5640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42589.exe
        5⤵
        
        PID:7032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8420.exe
        5⤵
        
        PID:8024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14618.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14618.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40264.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43470.exe
        5⤵
        
        PID:3516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        5⤵
        
        PID:4428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46090.exe
        5⤵
        
        PID:5744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8447.exe
        5⤵
        
        PID:6640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14289.exe
        5⤵
        
        PID:7548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6438.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6438.exe
      4⤵
      PID:1056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54936.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54936.exe
      4⤵
      PID:3388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10990.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10990.exe
      4⤵
      PID:5216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21459.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21459.exe
      4⤵
      PID:1356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53708.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53708.exe
      4⤵
      PID:1776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42122.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42122.exe
      4⤵
      PID:6140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21124.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21124.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16268.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16268.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26486.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56008.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64192.exe
        7⤵
        
        PID:816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43470.exe
        7⤵
        
        PID:3572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        7⤵
        
        PID:4716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62426.exe
        7⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8447.exe
        7⤵
        
        PID:6704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13970.exe
        7⤵
        
        PID:7176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7570.exe
        6⤵
        
        PID:2656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57206.exe
        6⤵
        
        PID:3580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13266.exe
        6⤵
        
        PID:4352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45738.exe
        6⤵
        
        PID:5820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45196.exe
        6⤵
        
        PID:6188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5395.exe
        6⤵
        
        PID:7396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45463.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64197.exe
        6⤵
        
        PID:2896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10772.exe
        7⤵
        
        PID:1460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55723.exe
        7⤵
        
        PID:3892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        7⤵
        
        PID:4160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43595.exe
        7⤵
        
        PID:5300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21507.exe
        7⤵
        
        PID:6556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31036.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57534.exe
        6⤵
        
        PID:3184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36964.exe
        6⤵
        
        PID:3512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15881.exe
        6⤵
        
        PID:6032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37638.exe
        6⤵
        
        PID:7060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12620.exe
        6⤵
        
        PID:7924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19063.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18350.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59203.exe
        6⤵
        
        PID:4100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-227.exe
        6⤵
        
        PID:6128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47054.exe
        6⤵
        
        PID:6988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29252.exe
        5⤵
        
        PID:3656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4601.exe
        5⤵
        
        PID:4344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37225.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17042.exe
        5⤵
        
        PID:6840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36740.exe
        5⤵
        
        PID:7668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6620.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6620.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43948.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58058.exe
        6⤵
        
        PID:1448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11862.exe
        7⤵
        
        PID:3316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28779.exe
        7⤵
        
        PID:1816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        7⤵
        
        PID:4468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46090.exe
        7⤵
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8447.exe
        7⤵
        
        PID:6760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13970.exe
        7⤵
        
        PID:3948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57534.exe
        6⤵
        
        PID:3124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42515.exe
        6⤵
        
        PID:4008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13266.exe
        6⤵
        
        PID:4524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27059.exe
        6⤵
        
        PID:5556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38573.exe
        6⤵
        
        PID:6380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-268.exe
        6⤵
        
        PID:7596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26516.exe
        5⤵
        
        PID:1716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64955.exe
        6⤵
        
        PID:3332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14331.exe
        6⤵
        
        PID:3964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13266.exe
        6⤵
        
        PID:4500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57845.exe
        6⤵
        
        PID:5864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57449.exe
        6⤵
        
        PID:6416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62572.exe
        6⤵
        
        PID:7736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2002.exe
        5⤵
        
        PID:3248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4601.exe
        5⤵
        
        PID:4676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20889.exe
        5⤵
        
        PID:5672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8977.exe
        5⤵
        
        PID:6256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9505.exe
        5⤵
        
        PID:6976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21097.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21097.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16528.exe
        5⤵
        
        PID:2056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54322.exe
        5⤵
        
        PID:3740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16661.exe
        5⤵
        
        PID:4888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44763.exe
        5⤵
        
        PID:5636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37254.exe
        5⤵
        
        PID:7024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12620.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45536.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45536.exe
      4⤵
      PID:1360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54406.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54406.exe
      4⤵
      PID:3684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53603.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53603.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37955.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37955.exe
      4⤵
      PID:5520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52983.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52983.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4170.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4170.exe
      4⤵
      PID:6964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26473.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26473.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17166.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17166.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10891.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57534.exe
        6⤵
        
        PID:3172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20196.exe
        6⤵
        
        PID:3344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4601.exe
        6⤵
        
        PID:4136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44125.exe
        6⤵
        
        PID:5500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61266.exe
        6⤵
        
        PID:7076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12620.exe
        6⤵
        
        PID:7916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37118.exe
        5⤵
        
        PID:1940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57206.exe
        5⤵
        
        PID:3492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13266.exe
        5⤵
        
        PID:4108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32416.exe
        5⤵
        
        PID:5960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38573.exe
        5⤵
        
        PID:6344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60.exe
        5⤵
        
        PID:7452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7362.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7362.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44161.exe
        5⤵
        
        PID:2736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45329.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59203.exe
        6⤵
        
        PID:4588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60645.exe
        6⤵
        
        PID:5428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38042.exe
        6⤵
        
        PID:6108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18757.exe
        6⤵
        
        PID:7116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25930.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64819.exe
        5⤵
        
        PID:3880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13266.exe
        5⤵
        
        PID:4580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37424.exe
        5⤵
        
        PID:5716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57449.exe
        5⤵
        
        PID:6424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31036.exe
        5⤵
        
        PID:7216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58259.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58259.exe
      4⤵
      PID:2552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17597.exe
        5⤵
        
        PID:1096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10798.exe
        5⤵
        
        PID:3836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        5⤵
        
        PID:4556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62426.exe
        5⤵
        
        PID:5260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8447.exe
        5⤵
        
        PID:6752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18054.exe
        5⤵
        
        PID:7604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43180.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43180.exe
      4⤵
      PID:2628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27654.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27654.exe
      4⤵
      PID:4028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53603.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53603.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32947.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32947.exe
      4⤵
      PID:5972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41838.exe
      4⤵
      PID:7128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50421.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50421.exe
      4⤵
      PID:7988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20984.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20984.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3683.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3683.exe
      4⤵
      PID:2624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21873.exe
        5⤵
        
        PID:2824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18966.exe
        5⤵
        
        PID:3452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        5⤵
        
        PID:4200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41082.exe
        5⤵
        
        PID:5944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8447.exe
        5⤵
        
        PID:6664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22841.exe
        5⤵
        
        PID:6948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29338.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29338.exe
      4⤵
      PID:1400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7347.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7347.exe
      4⤵
      PID:3228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4601.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4601.exe
      4⤵
      PID:4684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20889.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20889.exe
      4⤵
      PID:5704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17042.exe
      4⤵
      PID:6852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60098.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60098.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34125.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34125.exe
      4⤵
      PID:2908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55723.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55723.exe
      4⤵
      PID:3936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
      4⤵
      PID:4404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-973.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-973.exe
      4⤵
      PID:5548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8447.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8447.exe
      4⤵
      PID:6680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13970.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13970.exe
      4⤵
      PID:7192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21871.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21871.exe
    3⤵
    PID:2508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28185.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28185.exe
    3⤵
    PID:4068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49137.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49137.exe
    3⤵
    PID:4460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6081.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6081.exe
    3⤵
    PID:6024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51848.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51848.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50255.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50255.exe
    3⤵
    PID:7364
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8563.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8563.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28463.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28463.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28520.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28520.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13273.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65328.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64197.exe
        7⤵
        
        PID:2936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11862.exe
        8⤵
        
        PID:3292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28779.exe
        8⤵
        
        PID:3076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        8⤵
        
        PID:4516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50174.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8447.exe
        8⤵
        
        PID:6696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13970.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57534.exe
        7⤵
        
        PID:3136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42515.exe
        7⤵
        
        PID:4052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13266.exe
        7⤵
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27059.exe
        7⤵
        
        PID:5392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38573.exe
        7⤵
        
        PID:6320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9505.exe
        7⤵
        
        PID:7232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21664.exe
        6⤵
        
        PID:1072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60300.exe
        7⤵
        
        PID:1724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43470.exe
        7⤵
        
        PID:3592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        7⤵
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43595.exe
        7⤵
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21507.exe
        7⤵
        
        PID:6184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56419.exe
        7⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42343.exe
        7⤵
        
        PID:8036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45810.exe
        6⤵
        
        PID:2804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38567.exe
        6⤵
        
        PID:3540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4601.exe
        6⤵
        
        PID:4700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44125.exe
        6⤵
        
        PID:5404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61266.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41208.exe
        6⤵
        
        PID:7936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61415.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2910.exe
        6⤵
        
        PID:2944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45895.exe
        7⤵
        
        PID:952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46395.exe
        7⤵
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46708.exe
        7⤵
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42340.exe
        7⤵
        
        PID:7628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9651.exe
        6⤵
        
        PID:3628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        6⤵
        
        PID:4272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41082.exe
        6⤵
        
        PID:5952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8447.exe
        6⤵
        
        PID:6656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26926.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6292.exe
        5⤵
        
        PID:2128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50.exe
        6⤵
        
        PID:6984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15652.exe
        6⤵
        
        PID:8152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25168.exe
        5⤵
        
        PID:3748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4601.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37225.exe
        5⤵
        
        PID:5324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17042.exe
        5⤵
        
        PID:6824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8254.exe
        5⤵
        
        PID:7588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62837.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62837.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65328.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24312.exe
        6⤵
        
        PID:872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12219.exe
        6⤵
        
        PID:3536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13266.exe
        6⤵
        
        PID:1520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57845.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57449.exe
        6⤵
        
        PID:6300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31036.exe
        6⤵
        
        PID:6448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25743.exe
        5⤵
        
        PID:1572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32701.exe
        5⤵
        
        PID:3460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13266.exe
        5⤵
        
        PID:1188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27059.exe
        5⤵
        
        PID:5316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38573.exe
        5⤵
        
        PID:6340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9505.exe
        5⤵
        
        PID:6464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43594.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43594.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17026.exe
        5⤵
        
        PID:3032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43046.exe
        6⤵
        
        PID:3496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59203.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35217.exe
        6⤵
        
        PID:6080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17112.exe
        6⤵
        
        PID:6272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34589.exe
        6⤵
        
        PID:7336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5567.exe
        5⤵
        
        PID:3728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        5⤵
        
        PID:4604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43595.exe
        5⤵
        
        PID:5588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21507.exe
        5⤵
        
        PID:6608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35120.exe
        5⤵
        
        PID:7420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46117.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46117.exe
      4⤵
      PID:2420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11862.exe
        5⤵
        
        PID:3308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28779.exe
        5⤵
        
        PID:3080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        5⤵
        
        PID:4476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46090.exe
        5⤵
        
        PID:5752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8447.exe
        5⤵
        
        PID:6728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13970.exe
        5⤵
        
        PID:6532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4051.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4051.exe
      4⤵
      PID:3676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5131.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5131.exe
      4⤵
      PID:4596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24737.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24737.exe
      4⤵
      PID:5840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35396.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35396.exe
      4⤵
      PID:6196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27482.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27482.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61939.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61939.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49537.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49537.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4202.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5100.exe
        6⤵
        
        PID:2400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55510.exe
        7⤵
        
        PID:1372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38145.exe
        8⤵
        
        PID:3960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29728.exe
        9⤵
        
        PID:5508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32659.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40843.exe
        9⤵
        
        PID:6136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9274.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:7160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5970.exe
        8⤵
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8892.exe
        8⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63590.exe
        8⤵
        
        PID:7012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18220.exe
        8⤵
        
        PID:8016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61674.exe
        7⤵
        
        PID:3208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13266.exe
        7⤵
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57845.exe
        7⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57449.exe
        7⤵
        
        PID:6392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5395.exe
        7⤵
        
        PID:7308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3657.exe
        6⤵
        
        PID:624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14003.exe
        7⤵
        
        PID:3764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56561.exe
        7⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38042.exe
        7⤵
        
        PID:6152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12901.exe
        7⤵
        
        PID:7708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19302.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13266.exe
        6⤵
        
        PID:4620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41509.exe
        6⤵
        
        PID:5560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57449.exe
        6⤵
        
        PID:6368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31036.exe
        6⤵
        
        PID:7208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42603.exe
        5⤵
        
        PID:1008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18796.exe
        6⤵
        
        PID:3920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59203.exe
        6⤵
        
        PID:4444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60645.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5529.exe
        6⤵
        
        PID:7108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63874.exe
        6⤵
        
        PID:7996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5732.exe
        5⤵
        
        PID:1032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48380.exe
        5⤵
        
        PID:3848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4601.exe
        5⤵
        
        PID:4368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37225.exe
        5⤵
        
        PID:5304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45926.exe
        5⤵
        
        PID:6220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32540.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58042.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18697.exe
        5⤵
        
        PID:2976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11862.exe
        6⤵
        
        PID:3276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28779.exe
        6⤵
        
        PID:4024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41082.exe
        6⤵
        
        PID:6040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8447.exe
        6⤵
        
        PID:6688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26926.exe
        6⤵
        
        PID:7288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23386.exe
        5⤵
        
        PID:3720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13266.exe
        5⤵
        
        PID:4280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27059.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38573.exe
        5⤵
        
        PID:6292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57428.exe
        5⤵
        
        PID:8188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57107.exe
      4⤵
      PID:1784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55889.exe
        5⤵
        
        PID:652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53284.exe
        5⤵
        
        PID:3240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        5⤵
        
        PID:4216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43595.exe
        5⤵
        
        PID:5320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22594.exe
        5⤵
        
        PID:7140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13755.exe
        5⤵
        
        PID:7900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11597.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11597.exe
      4⤵
      PID:1968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39715.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39715.exe
      4⤵
      PID:3820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53603.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53603.exe
      4⤵
      PID:3976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46268.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46268.exe
      4⤵
      PID:5896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40731.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40731.exe
      4⤵
      PID:5784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23282.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23282.exe
      4⤵
      PID:6876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11227.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11227.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12370.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12370.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18697.exe
        5⤵
        
        PID:1864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11862.exe
        6⤵
        
        PID:3300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28779.exe
        6⤵
        
        PID:4084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        6⤵
        
        PID:4452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43595.exe
        6⤵
        
        PID:5456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21507.exe
        6⤵
        
        PID:6776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31036.exe
        6⤵
        
        PID:6872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57534.exe
        5⤵
        
        PID:3104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42515.exe
        5⤵
        
        PID:3980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13266.exe
        5⤵
        
        PID:4484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57845.exe
        5⤵
        
        PID:5760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38573.exe
        5⤵
        
        PID:5200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13589.exe
        5⤵
        
        PID:7412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61052.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61052.exe
      4⤵
      PID:1496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63673.exe
        5⤵
        
        PID:1576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16719.exe
        5⤵
        
        PID:4076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        5⤵
        
        PID:4120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41082.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-279.exe
        5⤵
        
        PID:6228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53695.exe
        5⤵
        
        PID:6980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5732.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5732.exe
      4⤵
      PID:1824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48380.exe
      4⤵
      PID:3872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4601.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4601.exe
      4⤵
      PID:4256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44763.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44763.exe
      4⤵
      PID:2092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58834.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58834.exe
      4⤵
      PID:7020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28442.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28442.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62142.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62142.exe
      4⤵
      PID:1296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20441.exe
        5⤵
        
        PID:3972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59203.exe
        5⤵
        
        PID:4176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52260.exe
        5⤵
        
        PID:2932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5529.exe
        5⤵
        
        PID:6156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35286.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9651.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9651.exe
      4⤵
      PID:3636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
      4⤵
      PID:4336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43595.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43595.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21507.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21507.exe
      4⤵
      PID:6540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1139.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1139.exe
      4⤵
      PID:7040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37451.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37451.exe
    3⤵
    PID:2116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15994.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15994.exe
      4⤵
      PID:3736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59203.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59203.exe
      4⤵
      PID:4248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48538.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48538.exe
      4⤵
      PID:5848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4860.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4860.exe
      4⤵
      PID:2012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49618.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49618.exe
      4⤵
      PID:6456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65504.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65504.exe
    3⤵
    PID:3788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5131.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5131.exe
    3⤵
    PID:4724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52988.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52988.exe
    3⤵
    PID:5540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47648.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47648.exe
    3⤵
    PID:6236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8370.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8370.exe
    3⤵
    PID:7200
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26691.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26691.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32604.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32604.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:3036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17166.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17166.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25391.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46382.exe
        6⤵
        
        PID:2088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17021.exe
        7⤵
        
        PID:2640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16303.exe
        7⤵
        
        PID:3408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13266.exe
        7⤵
        
        PID:4128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32416.exe
        7⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57449.exe
        7⤵
        
        PID:6264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38573.exe
        7⤵
        
        PID:6264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45384.exe
        7⤵
        
        PID:7372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21659.exe
        6⤵
        
        PID:944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57206.exe
        6⤵
        
        PID:3552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13266.exe
        6⤵
        
        PID:4732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27059.exe
        6⤵
        
        PID:5572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38573.exe
        6⤵
        
        PID:6328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9505.exe
        6⤵
        
        PID:6528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32437.exe
        5⤵
        
        PID:1804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22277.exe
        6⤵
        
        PID:6896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46898.exe
        6⤵
        
        PID:7836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2002.exe
        5⤵
        
        PID:3200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4601.exe
        5⤵
        
        PID:4492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44125.exe
        5⤵
        
        PID:5532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17042.exe
        5⤵
        
        PID:6816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4170.exe
        5⤵
        
        PID:7184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2785.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2785.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65110.exe
        5⤵
        
        PID:2060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9748.exe
        6⤵
        
        PID:940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30573.exe
        6⤵
        
        PID:5504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11247.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44381.exe
        6⤵
        
        PID:7784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23386.exe
        5⤵
        
        PID:3612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13266.exe
        5⤵
        
        PID:2484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27059.exe
        5⤵
        
        PID:5372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38573.exe
        5⤵
        
        PID:5376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9505.exe
        5⤵
        
        PID:6940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35400.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35400.exe
      4⤵
      PID:2360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45895.exe
        5⤵
        
        PID:3548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2748.exe
        6⤵
        
        PID:6100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39551.exe
        6⤵
        
        PID:6628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52418.exe
        6⤵
        
        PID:6412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26489.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48243.exe
        5⤵
        
        PID:6920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43255.exe
        5⤵
        
        PID:7428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29252.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29252.exe
      4⤵
      PID:3664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4601.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4601.exe
      4⤵
      PID:4380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37225.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37225.exe
      4⤵
      PID:5336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17042.exe
      4⤵
      PID:6860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60469.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60469.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6620.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6620.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18567.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18567.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10772.exe
        5⤵
        
        PID:2740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55723.exe
        5⤵
        
        PID:3928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43595.exe
        5⤵
        
        PID:5468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21507.exe
        5⤵
        
        PID:6472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31036.exe
        5⤵
        
        PID:7068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51016.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51016.exe
      4⤵
      PID:2584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22168.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22168.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4601.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4601.exe
      4⤵
      PID:4412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41309.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41309.exe
      4⤵
      PID:5492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17042.exe
      4⤵
      PID:6796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62322.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62322.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22584.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22584.exe
      4⤵
      PID:840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43470.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43470.exe
      4⤵
      PID:3588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
      4⤵
      PID:4312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41082.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41082.exe
      4⤵
      PID:5804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21507.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21507.exe
      4⤵
      PID:6568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1311.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1311.exe
      4⤵
      PID:7240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60419.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60419.exe
    3⤵
    PID:1704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54406.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54406.exe
    3⤵
    PID:3744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53603.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53603.exe
    3⤵
    PID:4184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50207.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50207.exe
    3⤵
    PID:6116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11707.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11707.exe
    3⤵
    PID:5768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12454.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12454.exe
    3⤵
    PID:7324
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32339.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32339.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26486.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26486.exe
    3⤵
    - Executes dropped EXE
    PID:2960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64368.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64368.exe
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:1748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60684.exe
        5⤵
        
        PID:2520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5444.exe
        5⤵
        
        PID:3796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15881.exe
        5⤵
        
        PID:6056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17042.exe
        5⤵
        
        PID:6804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4260.exe
        5⤵
        
        PID:7460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16122.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16122.exe
      4⤵
      PID:1796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32701.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32701.exe
      4⤵
      PID:3468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13266.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13266.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27059.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27059.exe
      4⤵
      PID:5416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38573.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38573.exe
      4⤵
      PID:5968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45145.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45145.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24082.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24082.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35220.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35220.exe
      4⤵
      PID:1136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43470.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43470.exe
      4⤵
      PID:3596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
      4⤵
      PID:4296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54403.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54403.exe
      4⤵
      PID:5828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61732.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61732.exe
      4⤵
      PID:6176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28121.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28121.exe
      4⤵
      PID:6888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8477.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8477.exe
    3⤵
    PID:2940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63071.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63071.exe
    3⤵
    PID:3400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4601.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4601.exe
    3⤵
    PID:4240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44125.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44125.exe
    3⤵
    PID:5344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61266.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61266.exe
    3⤵
    PID:7132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12620.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12620.exe
    3⤵
    PID:7884
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17555.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17555.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2915.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2915.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57534.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57534.exe
      4⤵
      PID:3160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20196.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20196.exe
      4⤵
      PID:3100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4601.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4601.exe
      4⤵
      PID:4692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44125.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44125.exe
      4⤵
      PID:5584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17042.exe
      4⤵
      PID:6828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4170.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4170.exe
      4⤵
      PID:6492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63268.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63268.exe
    3⤵
    PID:1972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24533.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24533.exe
    3⤵
    PID:3828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13266.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13266.exe
    3⤵
    PID:4288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32416.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32416.exe
    3⤵
    PID:5992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57449.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57449.exe
    3⤵
    PID:6312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31036.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31036.exe
    3⤵
    PID:6124
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30734.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30734.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19302.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19302.exe
    3⤵
    PID:3776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13266.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13266.exe
    3⤵
    PID:4612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27059.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27059.exe
    3⤵
    PID:5600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38573.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38573.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9505.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9505.exe
    3⤵
    PID:7224
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55657.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55657.exe
  2⤵
  PID:2424
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45657.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45657.exe
  2⤵
  PID:3908
- C:\Users\Admin\AppData\Local\Temp\Unicorn-43802.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-43802.exe
  2⤵
  PID:4760
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19373.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19373.exe
  2⤵
  PID:5612
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24113.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24113.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6248
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27970.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27970.exe
  2⤵
  PID:7404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Unicorn-23282.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-23282.exe
Size 468KB
SHA256 185b3e9d4ce0ab5d7100ebda47a29b36170d834f32d61ae05ee96676a910aaea
MD5 826cf18dc827008f95a402a1aade6460
SHA1 124d331e6ca89248b21d15e0f6157092bc5b901f
SHA512 ef24c5208cd20445e7e13e1e61deed2413c7548c74e346444295cfb96f3a0f9fe9703a871677170241c99c25746bef8208499cefc21136073edc6121d5ce7034
SSDEEP 3072:oqPEogTKjy822bY9PzsvqfU/Ekhjj+plPmHXLVzsdQUGZb7NV9le:oqMoXL22+Povqf0uOadQrV7NV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-28463.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-28463.exe
Size 468KB
SHA256 d5143e02bbfd3c34e35bca3976b88e31ab49101e3c886c37804cbf359be5f7f0
MD5 300925d5fdf78273227743bbce935c55
SHA1 1124409997501e0513f4cff950755e39db34e6ea
SHA512 ac6acfdda7e48b860aca896e9b6cda3f272d82045fc83c64f9568d54b3415dced0481daed72343e695ff1defbea00e36c2bf4ab8b00bb95fb7d9a31bfe296cef
SSDEEP 3072:lqPEogTKjy822bY9PzsvqfU/Ekhjj+plPmHXLVIjdQUGZb7NV9le:lqMoXL22+Povqf0uOQdQrV7NV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-32437.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-32437.exe
Size 468KB
SHA256 9fae42b7f5b564649991984bed3b677e885cb0d2393b22fc7c35f06ec2ccaf56
MD5 30b9b83202e06a9c2a6e6f4e3ba706ac
SHA1 b4a31da77b542472f7a69daed2105dbf229aaa24
SHA512 e78c7e4cd90507a22d3739fc2facf88a5f0d0544b6c1c409f0116b3b9ae445c54aa91defa36472dfbee0d4dc52c8855d926ba41d41431d2d4d92be33d6413b70
SSDEEP 3072:dqPEogTKjy822bY9PzsvRfU/Ekhdj+plPmHXLVIMdQLGZb7NV9le:dqMoXL22+PovRfCuO3dQyV7NV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-32604.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-32604.exe
Size 468KB
SHA256 6c41aedd4e11c396594c21a7eaef2a07d8e414da1e662499691af49a170f80d3
MD5 4a70684789bc2dc590b80c715ebf856c
SHA1 d2678ad670a918f7916828a581e121329d07354e
SHA512 dee4cd6a20eb852e732195395c13fd2413769f721706e750e4fb09d324aa26429fa820abfeec5fbb680da1d4735ac4334c81f4f138f1f4f952bd22fbf74a27d5
SSDEEP 3072:lqPEogTKjy822bY9PzsvqfU/Ekhdj+plPmHXLVIMdQLGZb7NV9le:lqMoXL22+PovqfCuO3dQyV7NV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-49618.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-49618.exe
Size 468KB
SHA256 a104fec220d40cdd940d2cffd54268c268c4f4dc276221bfa579c56bd716b4c3
MD5 ee56831adac7cc199820e9a945d9b7dc
SHA1 9fa79d94575d3597bb79fec7c04e4b3f1ac5d44e
SHA512 46fcd268a08f9dcae2252c94978446e4a8f8fffb91558ac96f467fc8f72eb020cd418a73f5e3c41ad60a2755e4d251505e3e61efec971532e68d6b178a6b46c3
SSDEEP 3072:6qPEogTKjy822bY9PzsvqfU/Ekhjj+plPmHXLVIsdQ3GZb7NV9le:6qMoXL22+Povqf0uOXdQWV7NV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-64670.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-64670.exe
Size 468KB
SHA256 b6f3e73b77d847a57166aa1058f22cc6396569d2314d7b481a76aa4a3c8333a7
MD5 9f6816c6e9df4153d3bbe2e0081919e5
SHA1 0c611c3000be9981e4ede5adeaeb2e1ce6bdd779
SHA512 46a012a8d6499bc0d1527351ed008bf4c80224a3bd0b7850be4cca626676214bec1b8981018d997cb122aeb6b308320afa3de362b202a4385776c8bde771311a
SSDEEP 3072:2qPEogTKjy822bY9PzsvqfU/Ekhjj+plPmHXLVIDdQLGZpANV9le:2qMoXL22+Povqf0uOAdQy3ANV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-16268.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-16268.exe
Size 468KB
SHA256 90e8f1b4e85897ca66b300102f0c0d707a4f92501c8a229ca44a68ef94af3bba
MD5 22d88d3b208cf620014bafc4877185cc
SHA1 a16023f1827a4afaa48aced52293cc11dd1d0526
SHA512 5419299310938936d44d146a29a053bd5a3d81dc4d079dee7159c4d0a570349a6e5f3823f804c33c603993670ec6fa923992fbc60e32119422891580f18a8c45
SSDEEP 3072:lqPEogTKjy822bY9PzlvqfU/Ekhjj+plPmHXLVIsdQLGZpnNV9le:lqMoXL22+P5vqf0uOXdQy3nNV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-21124.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-21124.exe
Size 468KB
SHA256 08953b44a4c3ff39a682ee13dad2b47ab017ddf8f6b03504b24cd7ea1a639688
MD5 d7fc5f3fdf965c70190530be6abd4bb2
SHA1 fe82516189a747724d7fdb5c08cd93ff35dd4c57
SHA512 746d5302db6eaf7ba8afd8214befd88156f3f73d0197e29269f060cb0723aacca0631983c10f101ce6f74177c249ee2dec736f125ef13a834202464540be8b5a
SSDEEP 3072:lqPEogTKjy822bY9PzsvqfU/Ekhjj+plPmHXLVIsdQLGZpnNV9le:lqMoXL22+Povqf0uOXdQy3nNV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-26473.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-26473.exe
Size 468KB
SHA256 78512ee7db0a58fcbb27a7d263c384fcf1e365415db30b164f41b2718651c58a
MD5 d2544238302c87b1c99f36f73d02e1e6
SHA1 f11be934a217dd8c049810a250ce9f96d9709caf
SHA512 5ae5bbb25f86caf714c4cc79cb1c17201100c7faeee260a0d74f6b295d366bb09ac729ab3af644baf2a657b3f1ccba7553cb09ade23960c525075f8a38b77910
SSDEEP 3072:lqPEogTKjy822bY9PzsvqfU/Ekhjj+plPmHXLVIsdQLGZh7NV9le:lqMoXL22+Povqf0uOXdQy/7NV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-26691.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-26691.exe
Size 468KB
SHA256 3ac0cfffc38a49cb6ef408b49cca03f9ecb25d5cc2dcf20e41920c4c3760da0f
MD5 d6348ff41796b29b84da213123f2f2ba
SHA1 c6f116b546d688aff74423c396bf519f3dc06cfb
SHA512 e3e29b825340174496eb8b21545f3036331b90dff74680b5d1ac3340c571e55602a069311196abe81130ad600171968f52b50797fe87123207285a93b12f576d
SSDEEP 3072:lqPEogTKjy822bY9PzsvqfU/Ekhdj+plPmHXLVIsdQLGZb7NV9le:lqMoXL22+PovqfCuOXdQyV7NV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-28520.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-28520.exe
Size 468KB
SHA256 530a6791526a26d9be85c3a859511d40c8d497b236aa166ae01d24c50430a5bf
MD5 cd7548565ac4352e04cb5e9fa7f5353f
SHA1 83b9dc747ab7bef8e1059f8fa6661a596674666f
SHA512 5ac9157d1d0e64cfc8b1875bf9142ba30c2ade3b1d12c738f6572951812d893c8d3b80d82fe58cd030e67bb5fd1096eff16704f4741d33c27496dc1d3536ba0f
SSDEEP 3072:lqPEogTKjy822bY9PzsvqfU/Ekhjj+plPmHXLVI0dQUGZb7NV9le:lqMoXL22+Povqf0uOXdQrV7NV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-28711.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-28711.exe
Size 468KB
SHA256 aca4f17ed628d12a1848d86ab6d9d1874ae2adb7d5008d17b6f02597c0ddcf5a
MD5 3230ca25730c35f3a2dc3ee5992e5c82
SHA1 73aebafd26c32f46a01552410654bdb1cc3deabf
SHA512 7023f5707887b078c05092e37277fbf548819b742de76f38d0841b5f2f14b9ae43a52bf8f9c2d5a671607a33f78118d14a45562b43df597017ceefa0d85f35b8
SSDEEP 3072:lqPEogTKjy822bY9PzsvqfU/Ekhjj+plPmHXLVIDdQLGZp7NVwle:lqMoXL22+Povqf0uOAdQy37NV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-31478.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-31478.exe
Size 468KB
SHA256 2b36c895ac3e472a05f4f539bdbc509808884906b3b15f2ed6ccdf77874f9d33
MD5 757777f7e38f57f40ab9e4100bf2eb69
SHA1 77be30bf7c00e42d2bdb536091b0dfbcb2aa57c2
SHA512 8ccde1434c0a1a9c86700632b81b37b743916f23d75961040ed992401c1619c56b3bef0a46fa7e8ad95f5a07b69d7ba7950f213e15c4d18db1aca94ed45b3f6e
SSDEEP 3072:lqPEogTKjy822bY9PzsvqfU/Ekhjj+plPmHXLVIDdQLGZp7NV9le:lqMoXL22+Povqf0uOAdQy37NV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-32339.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-32339.exe
Size 468KB
SHA256 2ec04a28336a8ee5070df3f66120617991ff80e0710135cd7592d39001e3ab8d
MD5 63c287b2e9538ffe24d50308440db1a0
SHA1 96aec1634326541ff98b119d0ff6fb7233405c66
SHA512 d5567a9066ed14a24640e6891a35fe5c86e78c579363aa8171015e6d68e486a6bd8faa516de9e6006d52c56d81054286acbca93713a9da20191699cb3a62c3ef
SSDEEP 3072:lqPEogTKjy822bY9PzsvqfU/EVhjj+plPmHXLVIsdQLGZb7NV9le:lqMoXL22+PovqfHuOXdQyV7NV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-32513.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-32513.exe
Size 468KB
SHA256 4c45cf732d066881756f444f5addff05cca83307a87af56bb8da9d65f0714510
MD5 5fb2e01f7ffff0a19231ada8564af934
SHA1 9907509af39f0e16329d29a2b81211a6539da9c3
SHA512 927429fa0fbcd76cd2936b87c763b3e39e314f545fb4a3d5c47d8822e98348d2818b3a76871e422debce2bffb68d9e180af8c94ca90fe9ade32ac21760086ba8
SSDEEP 3072:lqPEogTKjy822bY9PzsvqfU/Ekhjj+plPmHXLVIldQLGZp7NV9le:lqMoXL22+Povqf0uOadQy37NV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-42447.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-42447.exe
Size 468KB
SHA256 1bf931e6a33a21e54c36bb9ba08d42e21a99f5c1ec59675a9285873eb2985c7b
MD5 3226eaeadab14860908e438a67fc5f59
SHA1 15e939253cf49f2182019ae72857b900d260a2ac
SHA512 89e1464cade04c3a72b363cb0455e16766ebad1177b312f44fa5178f91630171938a8f4c49cbe03d147a02ac9cb3f45d1572cda995b6badfa9729a59a5d0b2c0
SSDEEP 3072:lqPEogTKjy822bY9PzsvqfU/Ekhjj+plPmHXLVIl8QLGZp7NV9le:lqMoXL22+Povqf0uOa8Qy37NV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-48577.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-48577.exe
Size 468KB
SHA256 de1d8aae835727f104ba3335d608c6c8d6fd64fc6eb4c1b0dd0dd204715c18e0
MD5 0bef546bae6791a60fbc9256c6a19286
SHA1 58b35d3f13f93fe5079d3b5d81783baff92d1f50
SHA512 1e525e792de4f38e97607817aa49c325fbd85152fe7d38530f5f7c7019aa929fdcc960f539f11c6ceab97796a99dea303ebb3f1754190846f77cd9ff3c21b4e1
SSDEEP 3072:lqPEogTKjy822bY9PzsvqfU/Ekhjj+plPmHXLVIDdQLGZYANV9le:lqMoXL22+Povqf0uOAdQySANV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-49560.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-49560.exe
Size 468KB
SHA256 80c68d07d87b277515292945b410ff1df83e17c8e9238cd3714786b9405bce24
MD5 069ddf2ec31bae4c27b1a251ee0b2289
SHA1 f0a24a5c5831eeb5daf5234c92674dd4680e26c7
SHA512 0495662b1bf82ec2533f7e01a05eeba6036a89b0ea62a17234bd30e743067665a196780597d051dc453c5c0067f850b9c1a440df5405d19156600e1488999cef
SSDEEP 3072:lqPEogTKjy822bY9PzsvqfU/Ekhjj+plPmHXLVIsdQLGZp7NV9le:lqMoXL22+Povqf0uOXdQy37NV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-52256.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-52256.exe
Size 468KB
SHA256 24d266fdfe80df30cd3d1e883deda352a9830dc858de4b30b22378c3eaf82f34
MD5 7ce4bc7f1f580f050b2925fa045ea98d
SHA1 11294e96d08b58fe545e7f93fc200f3fb37fbe3f
SHA512 64b37157d2b3800ef25df6e139d04ab80bc1e2fc7dbeb86a392fea9248c2d8273ef8e61d8f2e90c2d08e10b2828c30124f5e4f1b17812f35ae027916ca40b341
SSDEEP 3072:lqPEogTKjy822bY9PzsvqfU/Ekhjj+plPmHXLVIDdQLGZpANV9le:lqMoXL22+Povqf0uOAdQy3ANV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-54155.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-54155.exe
Size 468KB
SHA256 f17bf6e2b61ef2f681bf724ecfd82e7cf2a1a8cb710dc168e2eda493785341bf
MD5 b10cd38eb4af138ec1c6d5f21e9f2619
SHA1 5b513f4b3229640b569e49b2d32a7c1d2f396e5a
SHA512 b6dd84c1b1a532c1dcb99f9937ba732b18b04883489a125f4e91c8eb37d0a772513006161d17e9abee71b21eb0f7658092d6faad511efe7f9cd90935ab9578e8
SSDEEP 3072:lqPEogTKjy822bY9PzsvqfU/EkBjj+plPmHXLVIldQLGZp7NV9le:lqMoXL22+PovqfUuOadQy37NV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-61939.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-61939.exe
Size 468KB
SHA256 5fc06f8eac28b95e439408d543197cbead8b4903ee70b541aa675813ed23a5d0
MD5 6c5d1e90d078dc42f754b11a61caced9
SHA1 10cf380e27553ec242ee43def1d9fef6c045c90f
SHA512 ade1c7ddb6802aa3580d09e46901b92aada5790fa9a9b9c70a48e0ca0f0f8b736b9172e4936d2d6092346ef0083f4641e7038c1967398521dbf2af58a420aef5
SSDEEP 3072:lqPEogTKjy822bY9PzsvqfU/Ekhjj+plPmHXLVzsdQUGZb7NV9le:lqMoXL22+Povqf0uOadQrV7NV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-65105.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-65105.exe
Size 468KB
SHA256 0390fff0eb91b5460004021fbfffef89f6d4ffac7e1cb9fbf46aad0c910fbc8f
MD5 106a80e80d2acfb1cc93e8fcc4c3503e
SHA1 4d49d594ac0e9a3e7779ff2cec14bc52a9f6b22a
SHA512 4192bf24fbc5d449fc29a1d81a1450d579c6d869a09d23063780a5fb33e313844f68c9b2027be746745227dcf58661f531cc0243e48ad51b3b9dd75468d5585d
SSDEEP 3072:lqPEogTKjy822bY9PzsvqfU/EkBjj+plPmHXLVIldQLGZp7NV9la:lqMoXL22+PovqfUuOadQy37NV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-8563.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-8563.exe
Size 468KB
SHA256 f650da4a4abad58553a6f4a40b391ceacedf516ab9250f392e04dd8c9b0c69b8
MD5 49d8e10cf0c67592e36cda8f04344c68
SHA1 fc370a85a808c2f9c6e7af7f44ecc9827a81a452
SHA512 48ccdd79aabc4270740a6919c949d889a4d6b6a86dc031b11b84689f7f47cda288be54c1aea2951fbfd27ae3ee15063a0bf83c0651ef44134ed7276c15421126
SSDEEP 3072:lqPEogTKjy822bY9PzsvqfU/Ekhjj+plPmHXLVIsdQUGZb7NV9le:lqMoXL22+Povqf0uOXdQrV7NV
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/388-313-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/388-0-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/388-171-0x0000000002690000-0x0000000002705000-memory.dmp

Download

memory/388-357-0x0000000002690000-0x0000000002705000-memory.dmp

Download

memory/388-5-0x0000000002690000-0x0000000002705000-memory.dmp

Download

memory/388-309-0x0000000002690000-0x0000000002705000-memory.dmp

Download

memory/388-84-0x0000000002690000-0x0000000002705000-memory.dmp

Download

memory/388-344-0x0000000002690000-0x0000000002705000-memory.dmp

Download

memory/388-31-0x0000000002690000-0x0000000002705000-memory.dmp

Download

memory/388-178-0x0000000002690000-0x0000000002705000-memory.dmp

Download

memory/712-233-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/900-285-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1064-399-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1104-260-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1152-267-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1160-163-0x0000000000840000-0x00000000008B5000-memory.dmp

Download

memory/1160-85-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1160-168-0x0000000000840000-0x00000000008B5000-memory.dmp

Download

memory/1160-304-0x0000000000840000-0x00000000008B5000-memory.dmp

Download

memory/1160-301-0x0000000000840000-0x00000000008B5000-memory.dmp

Download

memory/1284-284-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1464-157-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1464-288-0x0000000002910000-0x0000000002985000-memory.dmp

Download

memory/1548-392-0x0000000000480000-0x00000000004F5000-memory.dmp

Download

memory/1548-247-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1548-396-0x0000000000480000-0x00000000004F5000-memory.dmp

Download

memory/1592-391-0x0000000000330000-0x00000000003A5000-memory.dmp

Download

memory/1592-232-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1620-307-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1656-246-0x0000000002560000-0x00000000025D5000-memory.dmp

Download

memory/1656-242-0x0000000002560000-0x00000000025D5000-memory.dmp

Download

memory/1656-132-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1712-126-0x0000000002680000-0x00000000026F5000-memory.dmp

Download

memory/1712-366-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1712-33-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1712-265-0x0000000002680000-0x00000000026F5000-memory.dmp

Download

memory/1712-256-0x0000000002680000-0x00000000026F5000-memory.dmp

Download

memory/1764-264-0x0000000000480000-0x00000000004F5000-memory.dmp

Download

memory/1764-121-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1764-266-0x0000000000480000-0x00000000004F5000-memory.dmp

Download

memory/1828-290-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2076-397-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2144-393-0x00000000025F0000-0x0000000002665000-memory.dmp

Download

memory/2144-398-0x00000000027F0000-0x0000000002865000-memory.dmp

Download

memory/2144-395-0x00000000025F0000-0x0000000002665000-memory.dmp

Download

memory/2144-47-0x00000000027F0000-0x0000000002865000-memory.dmp

Download

memory/2144-213-0x00000000025F0000-0x0000000002665000-memory.dmp

Download

memory/2144-368-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2144-214-0x00000000025F0000-0x0000000002665000-memory.dmp

Download

memory/2144-34-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2460-314-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2532-302-0x0000000002C40000-0x0000000002CB5000-memory.dmp

Download

memory/2532-144-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2532-300-0x0000000002C40000-0x0000000002CB5000-memory.dmp

Download

memory/2576-373-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2588-105-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2588-198-0x00000000025F0000-0x0000000002665000-memory.dmp

Download

memory/2588-197-0x00000000025F0000-0x0000000002665000-memory.dmp

Download

memory/2588-349-0x00000000025F0000-0x0000000002665000-memory.dmp

Download

memory/2588-348-0x00000000025F0000-0x0000000002665000-memory.dmp

Download

memory/2596-218-0x0000000000480000-0x00000000004F5000-memory.dmp

Download

memory/2596-361-0x0000000000480000-0x00000000004F5000-memory.dmp

Download

memory/2596-231-0x0000000000480000-0x00000000004F5000-memory.dmp

Download

memory/2660-282-0x0000000000480000-0x00000000004F5000-memory.dmp

Download

memory/2660-69-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2660-280-0x0000000000480000-0x00000000004F5000-memory.dmp

Download

memory/2664-394-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2672-339-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2680-372-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2760-142-0x0000000000480000-0x00000000004F5000-memory.dmp

Download

memory/2760-137-0x0000000000480000-0x00000000004F5000-memory.dmp

Download

memory/2760-305-0x0000000000480000-0x00000000004F5000-memory.dmp

Download

memory/2760-71-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2768-358-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2772-353-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2772-281-0x0000000002730000-0x00000000027A5000-memory.dmp

Download

memory/2772-283-0x0000000002730000-0x00000000027A5000-memory.dmp

Download

memory/2772-153-0x0000000002730000-0x00000000027A5000-memory.dmp

Download

memory/2772-59-0x0000000002730000-0x00000000027A5000-memory.dmp

Download

memory/2772-32-0x0000000002730000-0x00000000027A5000-memory.dmp

Download

memory/2828-350-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2920-180-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2920-299-0x0000000000480000-0x00000000004F5000-memory.dmp

Download

memory/2920-303-0x0000000000480000-0x00000000004F5000-memory.dmp

Download

memory/2960-1279-0x00000000029B0000-0x0000000002B0C000-memory.dmp

Download

memory/2960-306-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2968-230-0x0000000002430000-0x00000000024A5000-memory.dmp

Download

memory/2968-49-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2968-221-0x0000000002430000-0x00000000024A5000-memory.dmp

Download

memory/2968-92-0x0000000002430000-0x00000000024A5000-memory.dmp

Download

memory/3036-173-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3036-289-0x0000000002720000-0x0000000002795000-memory.dmp

Download

memory/3036-287-0x0000000002720000-0x0000000002795000-memory.dmp

Download

memory/3040-337-0x0000000000480000-0x00000000004F5000-memory.dmp

Download

memory/3040-200-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3040-338-0x0000000000480000-0x00000000004F5000-memory.dmp

Download

memory/3044-215-0x0000000000400000-0x0000000000475000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads