9b1f4880913280cb0b75a29298197ef202e77bb66105113f6fbd0dd70c3966a0

Analysis

max time kernel
119s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2024, 13:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9b1f4880913280cb0b75a29298197ef202e77bb66105113f6fbd0dd70c3966a0N.exe
Size

468KB
MD5

f1dc589a16ab21a0d06907c2cc5cf1b0
SHA1

cebbf6e43e9fb9a4d68849287d3aac0718bfb889
SHA256

9b1f4880913280cb0b75a29298197ef202e77bb66105113f6fbd0dd70c3966a0
SHA512

ec18f9480425e7728fb82fdbdb5d32b23912cf806e9103a0734d668a8c4e6ebf10f1c23eb1b543e8d118a19c15e53da1f582ca9dfa5f2a9fdb9f317602dec55e
SSDEEP

3072:8um8ogWxj28x2bYcPz3gqf8/lCZjG4pl4mHx8/j33zg+xGoN2nlu:8uhoxXx2XPDgqf0E7m3zXAoN2

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2448	Unicorn-11977.exe
1500	Unicorn-18138.exe
4564	Unicorn-55641.exe
4580	Unicorn-65366.exe
2064	Unicorn-58350.exe
2092	Unicorn-52220.exe
3600	Unicorn-30316.exe
2536	Unicorn-51874.exe
372	Unicorn-23840.exe
2472	Unicorn-35538.exe
2344	Unicorn-23286.exe
1092	Unicorn-23021.exe
1508	Unicorn-3420.exe
1436	Unicorn-13071.exe
4600	Unicorn-34312.exe
408	Unicorn-26742.exe
4004	Unicorn-61644.exe
2752	Unicorn-51054.exe
2848	Unicorn-38802.exe
3324	Unicorn-26285.exe
4320	Unicorn-30996.exe
3972	Unicorn-26358.exe
4832	Unicorn-12059.exe
2424	Unicorn-10021.exe
4388	Unicorn-1853.exe
3616	Unicorn-63306.exe
2912	Unicorn-50292.exe
2704	Unicorn-32340.exe
2676	Unicorn-32340.exe
3784	Unicorn-19726.exe
2688	Unicorn-1343.exe
2396	Unicorn-28818.exe
3996	Unicorn-16928.exe
2496	Unicorn-4121.exe
3320	Unicorn-58485.exe
2520	Unicorn-13441.exe
732	Unicorn-45730.exe
860	Unicorn-60212.exe
1788	Unicorn-46477.exe
3724	Unicorn-805.exe
3160	Unicorn-27208.exe
4284	Unicorn-14401.exe
3956	Unicorn-33867.exe
208	Unicorn-51158.exe
64	Unicorn-42606.exe
1432	Unicorn-42606.exe
232	Unicorn-6404.exe
2216	Unicorn-59689.exe
2564	Unicorn-5849.exe
184	Unicorn-55050.exe
3016	Unicorn-25500.exe
2096	Unicorn-31100.exe
3712	Unicorn-46498.exe
3884	Unicorn-38330.exe
1376	Unicorn-11779.exe
2468	Unicorn-63581.exe
4428	Unicorn-17910.exe
4380	Unicorn-65064.exe
4880	Unicorn-5392.exe
888	Unicorn-27230.exe
1904	Unicorn-60649.exe
3232	Unicorn-14977.exe
912	Unicorn-6544.exe
1776	Unicorn-23316.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
15836	13804	WerFault.exe	681

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33480.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16554.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33786.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5702.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19994.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43841.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22230.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50852.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44954.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52220.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45730.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57985.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46064.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36595.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26285.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65064.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15029.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32298.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27208.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17363.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1121.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63029.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40164.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26315.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33124.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21058.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1324.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14019.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20099.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26315.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22852.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50917.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56087.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30316.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19726.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9321.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57881.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48012.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30399.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1810.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53120.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55162.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42504.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6568.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17649.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58588.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64425.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4396.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12017.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65494.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54617.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65162.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33486.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3331.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34312.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10899.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2253.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65494.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7881.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2599.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58490.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29918.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53566.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25504.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	14656	dwm.exe
Token: SeChangeNotifyPrivilege	14656	dwm.exe
Token: 33	14656	dwm.exe
Token: SeIncBasePriorityPrivilege	14656	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
876	9b1f4880913280cb0b75a29298197ef202e77bb66105113f6fbd0dd70c3966a0N.exe
2448	Unicorn-11977.exe
1500	Unicorn-18138.exe
4564	Unicorn-55641.exe
4580	Unicorn-65366.exe
2064	Unicorn-58350.exe
2092	Unicorn-52220.exe
3600	Unicorn-30316.exe
372	Unicorn-23840.exe
2536	Unicorn-51874.exe
1436	Unicorn-13071.exe
2344	Unicorn-23286.exe
1508	Unicorn-3420.exe
1092	Unicorn-23021.exe
2472	Unicorn-35538.exe
4600	Unicorn-34312.exe
408	Unicorn-26742.exe
4004	Unicorn-61644.exe
2752	Unicorn-51054.exe
2848	Unicorn-38802.exe
3324	Unicorn-26285.exe
4320	Unicorn-30996.exe
3972	Unicorn-26358.exe
4388	Unicorn-1853.exe
3616	Unicorn-63306.exe
4832	Unicorn-12059.exe
2676	Unicorn-32340.exe
2704	Unicorn-32340.exe
2912	Unicorn-50292.exe
2424	Unicorn-10021.exe
2688	Unicorn-1343.exe
3784	Unicorn-19726.exe
2396	Unicorn-28818.exe
3996	Unicorn-16928.exe
2496	Unicorn-4121.exe
3320	Unicorn-58485.exe
2520	Unicorn-13441.exe
732	Unicorn-45730.exe
3724	Unicorn-805.exe
1788	Unicorn-46477.exe
860	Unicorn-60212.exe
3160	Unicorn-27208.exe
4284	Unicorn-14401.exe
3956	Unicorn-33867.exe
208	Unicorn-51158.exe
1432	Unicorn-42606.exe
64	Unicorn-42606.exe
232	Unicorn-6404.exe
3712	Unicorn-46498.exe
2468	Unicorn-63581.exe
2096	Unicorn-31100.exe
3884	Unicorn-38330.exe
3016	Unicorn-25500.exe
4380	Unicorn-65064.exe
2564	Unicorn-5849.exe
184	Unicorn-55050.exe
2216	Unicorn-59689.exe
4428	Unicorn-17910.exe
4880	Unicorn-5392.exe
1376	Unicorn-11779.exe
1904	Unicorn-60649.exe
912	Unicorn-6544.exe
888	Unicorn-27230.exe
3232	Unicorn-14977.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 876 wrote to memory of 2448	876	9b1f4880913280cb0b75a29298197ef202e77bb66105113f6fbd0dd70c3966a0N.exe	82
PID 876 wrote to memory of 2448	876	9b1f4880913280cb0b75a29298197ef202e77bb66105113f6fbd0dd70c3966a0N.exe	82
PID 876 wrote to memory of 2448	876	9b1f4880913280cb0b75a29298197ef202e77bb66105113f6fbd0dd70c3966a0N.exe	82
PID 2448 wrote to memory of 1500	2448	Unicorn-11977.exe	87
PID 2448 wrote to memory of 1500	2448	Unicorn-11977.exe	87
PID 2448 wrote to memory of 1500	2448	Unicorn-11977.exe	87
PID 876 wrote to memory of 4564	876	9b1f4880913280cb0b75a29298197ef202e77bb66105113f6fbd0dd70c3966a0N.exe	88
PID 876 wrote to memory of 4564	876	9b1f4880913280cb0b75a29298197ef202e77bb66105113f6fbd0dd70c3966a0N.exe	88
PID 876 wrote to memory of 4564	876	9b1f4880913280cb0b75a29298197ef202e77bb66105113f6fbd0dd70c3966a0N.exe	88
PID 4564 wrote to memory of 4580	4564	Unicorn-55641.exe	90
PID 4564 wrote to memory of 4580	4564	Unicorn-55641.exe	90
PID 4564 wrote to memory of 4580	4564	Unicorn-55641.exe	90
PID 1500 wrote to memory of 2064	1500	Unicorn-18138.exe	91
PID 1500 wrote to memory of 2064	1500	Unicorn-18138.exe	91
PID 1500 wrote to memory of 2064	1500	Unicorn-18138.exe	91
PID 876 wrote to memory of 2092	876	9b1f4880913280cb0b75a29298197ef202e77bb66105113f6fbd0dd70c3966a0N.exe	92
PID 876 wrote to memory of 2092	876	9b1f4880913280cb0b75a29298197ef202e77bb66105113f6fbd0dd70c3966a0N.exe	92
PID 876 wrote to memory of 2092	876	9b1f4880913280cb0b75a29298197ef202e77bb66105113f6fbd0dd70c3966a0N.exe	92
PID 2448 wrote to memory of 3600	2448	Unicorn-11977.exe	93
PID 2448 wrote to memory of 3600	2448	Unicorn-11977.exe	93
PID 2448 wrote to memory of 3600	2448	Unicorn-11977.exe	93
PID 4580 wrote to memory of 2536	4580	Unicorn-65366.exe	96
PID 4580 wrote to memory of 2536	4580	Unicorn-65366.exe	96
PID 4580 wrote to memory of 2536	4580	Unicorn-65366.exe	96
PID 4564 wrote to memory of 372	4564	Unicorn-55641.exe	97
PID 4564 wrote to memory of 372	4564	Unicorn-55641.exe	97
PID 4564 wrote to memory of 372	4564	Unicorn-55641.exe	97
PID 3600 wrote to memory of 2472	3600	Unicorn-30316.exe	98
PID 3600 wrote to memory of 2472	3600	Unicorn-30316.exe	98
PID 3600 wrote to memory of 2472	3600	Unicorn-30316.exe	98
PID 2064 wrote to memory of 2344	2064	Unicorn-58350.exe	99
PID 2064 wrote to memory of 2344	2064	Unicorn-58350.exe	99
PID 2064 wrote to memory of 2344	2064	Unicorn-58350.exe	99
PID 876 wrote to memory of 1092	876	9b1f4880913280cb0b75a29298197ef202e77bb66105113f6fbd0dd70c3966a0N.exe	100
PID 876 wrote to memory of 1092	876	9b1f4880913280cb0b75a29298197ef202e77bb66105113f6fbd0dd70c3966a0N.exe	100
PID 876 wrote to memory of 1092	876	9b1f4880913280cb0b75a29298197ef202e77bb66105113f6fbd0dd70c3966a0N.exe	100
PID 1500 wrote to memory of 1508	1500	Unicorn-18138.exe	101
PID 1500 wrote to memory of 1508	1500	Unicorn-18138.exe	101
PID 1500 wrote to memory of 1508	1500	Unicorn-18138.exe	101
PID 2448 wrote to memory of 1436	2448	Unicorn-11977.exe	102
PID 2448 wrote to memory of 1436	2448	Unicorn-11977.exe	102
PID 2448 wrote to memory of 1436	2448	Unicorn-11977.exe	102
PID 2092 wrote to memory of 4600	2092	Unicorn-52220.exe	103
PID 2092 wrote to memory of 4600	2092	Unicorn-52220.exe	103
PID 2092 wrote to memory of 4600	2092	Unicorn-52220.exe	103
PID 372 wrote to memory of 408	372	Unicorn-23840.exe	104
PID 372 wrote to memory of 408	372	Unicorn-23840.exe	104
PID 372 wrote to memory of 408	372	Unicorn-23840.exe	104
PID 4564 wrote to memory of 4004	4564	Unicorn-55641.exe	105
PID 4564 wrote to memory of 4004	4564	Unicorn-55641.exe	105
PID 4564 wrote to memory of 4004	4564	Unicorn-55641.exe	105
PID 1436 wrote to memory of 2752	1436	Unicorn-13071.exe	106
PID 1436 wrote to memory of 2752	1436	Unicorn-13071.exe	106
PID 1436 wrote to memory of 2752	1436	Unicorn-13071.exe	106
PID 2536 wrote to memory of 2848	2536	Unicorn-51874.exe	107
PID 2536 wrote to memory of 2848	2536	Unicorn-51874.exe	107
PID 2536 wrote to memory of 2848	2536	Unicorn-51874.exe	107
PID 2448 wrote to memory of 3324	2448	Unicorn-11977.exe	108
PID 2448 wrote to memory of 3324	2448	Unicorn-11977.exe	108
PID 2448 wrote to memory of 3324	2448	Unicorn-11977.exe	108
PID 4580 wrote to memory of 4320	4580	Unicorn-65366.exe	109
PID 4580 wrote to memory of 4320	4580	Unicorn-65366.exe	109
PID 4580 wrote to memory of 4320	4580	Unicorn-65366.exe	109
PID 1508 wrote to memory of 3972	1508	Unicorn-3420.exe	110

C:\Users\Admin\AppData\Local\Temp\9b1f4880913280cb0b75a29298197ef202e77bb66105113f6fbd0dd70c3966a0N.exe
"C:\Users\Admin\AppData\Local\Temp\9b1f4880913280cb0b75a29298197ef202e77bb66105113f6fbd0dd70c3966a0N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:876
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11977.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11977.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18138.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18138.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58350.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58350.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23286.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1853.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42606.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:64
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34194.exe
        8⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59954.exe
        9⤵
        
        PID:6348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65494.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:8868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40164.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:12432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30399.exe
        10⤵
        
        PID:14548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54949.exe
        9⤵
        
        PID:9204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52120.exe
        9⤵
        
        PID:12984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18146.exe
        9⤵
        
        PID:15296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17363.exe
        8⤵
        
        PID:8072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54617.exe
        8⤵
        
        PID:11052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14395.exe
        8⤵
        
        PID:14168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15247.exe
        8⤵
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27504.exe
        7⤵
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21382.exe
        8⤵
        
        PID:5460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3331.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25504.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22675.exe
        8⤵
        
        PID:14744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58987.exe
        8⤵
        
        PID:16160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34275.exe
        7⤵
        
        PID:7988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3715.exe
        7⤵
        
        PID:11480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13812.exe
        7⤵
        
        PID:15328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43301.exe
        7⤵
        
        PID:17016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59689.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30494.exe
        7⤵
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31174.exe
        8⤵
        
        PID:6316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61026.exe
        9⤵
        
        PID:8904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56012.exe
        9⤵
        
        PID:13432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8546.exe
        9⤵
        
        PID:2436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34039.exe
        8⤵
        
        PID:9492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21996.exe
        8⤵
        
        PID:13892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30965.exe
        8⤵
        
        PID:17676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1324.exe
        7⤵
        
        PID:6460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65494.exe
        8⤵
        
        PID:8884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56012.exe
        8⤵
        
        PID:13588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51883.exe
        8⤵
        
        PID:17572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60516.exe
        7⤵
        
        PID:9236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57985.exe
        7⤵
        
        PID:12956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58682.exe
        7⤵
        
        PID:5964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23979.exe
        6⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        7⤵
        
        PID:7128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51078.exe
        8⤵
        
        PID:9684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33916.exe
        8⤵
        
        PID:12320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28583.exe
        8⤵
        
        PID:16392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49085.exe
        7⤵
        
        PID:9668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20407.exe
        7⤵
        
        PID:13776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48309.exe
        6⤵
        
        PID:7912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12453.exe
        7⤵
        
        PID:11748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19412.exe
        7⤵
        
        PID:13832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46071.exe
        7⤵
        
        PID:16912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21831.exe
        6⤵
        
        PID:10808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1176.exe
        6⤵
        
        PID:4948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33852.exe
        6⤵
        
        PID:16848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32340.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17910.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59082.exe
        7⤵
        
        PID:5132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44194.exe
        8⤵
        
        PID:6600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3849.exe
        9⤵
        
        PID:8224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8068.exe
        9⤵
        
        PID:13032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3931.exe
        9⤵
        
        PID:13976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65339.exe
        9⤵
        
        PID:17020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18819.exe
        8⤵
        
        PID:10192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63029.exe
        8⤵
        
        PID:13980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53735.exe
        8⤵
        
        PID:16644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-748.exe
        7⤵
        
        PID:6884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16102.exe
        8⤵
        
        PID:9048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39972.exe
        8⤵
        
        PID:12708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14830.exe
        8⤵
        
        PID:1808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57584.exe
        7⤵
        
        PID:9276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57985.exe
        7⤵
        
        PID:12928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42154.exe
        7⤵
        
        PID:16236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7660.exe
        6⤵
        
        PID:5944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5045.exe
        7⤵
        
        PID:6324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29588.exe
        7⤵
        
        PID:10040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3879.exe
        7⤵
        
        PID:13932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26315.exe
        7⤵
        
        PID:15428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5495.exe
        6⤵
        
        PID:7860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55001.exe
        6⤵
        
        PID:10712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20643.exe
        6⤵
        
        PID:15216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6926.exe
        6⤵
        
        PID:16092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65064.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37400.exe
        6⤵
        
        PID:3248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13789.exe
        7⤵
        
        PID:7300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19158.exe
        8⤵
        
        PID:16100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42504.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18976.exe
        7⤵
        
        PID:15284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62958.exe
        7⤵
        
        PID:3312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2179.exe
        6⤵
        
        PID:7172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23481.exe
        6⤵
        
        PID:11308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29179.exe
        6⤵
        
        PID:11844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10011.exe
        6⤵
        
        PID:4308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47105.exe
        5⤵
        
        PID:5564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9321.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57814.exe
        7⤵
        
        PID:8760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29744.exe
        7⤵
        
        PID:14960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56734.exe
        7⤵
        
        PID:16576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21420.exe
        6⤵
        
        PID:10132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65332.exe
        6⤵
        
        PID:14124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1810.exe
        6⤵
        
        PID:4476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2695.exe
        5⤵
        
        PID:7844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45894.exe
        6⤵
        
        PID:12140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27387.exe
        6⤵
        
        PID:15808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42179.exe
        6⤵
        
        PID:16776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36816.exe
        5⤵
        
        PID:10540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25258.exe
        5⤵
        
        PID:15304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6893.exe
        5⤵
        
        PID:16752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3420.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3420.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26358.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51158.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63166.exe
        7⤵
        
        PID:2572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48470.exe
        8⤵
        
        PID:6700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5629.exe
        9⤵
        
        PID:12000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16365.exe
        9⤵
        
        PID:7320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55576.exe
        8⤵
        
        PID:9244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14980.exe
        8⤵
        
        PID:14204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21733.exe
        8⤵
        
        PID:14648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18131.exe
        7⤵
        
        PID:7436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36885.exe
        7⤵
        
        PID:11424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30347.exe
        7⤵
        
        PID:15252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8195.exe
        7⤵
        
        PID:16984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7852.exe
        6⤵
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21382.exe
        7⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40414.exe
        8⤵
        
        PID:9176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55820.exe
        8⤵
        
        PID:12932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58987.exe
        8⤵
        
        PID:16128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58265.exe
        7⤵
        
        PID:8452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54284.exe
        7⤵
        
        PID:13292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26315.exe
        7⤵
        
        PID:14804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37977.exe
        6⤵
        
        PID:8160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65256.exe
        7⤵
        
        PID:1816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41240.exe
        6⤵
        
        PID:11884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49741.exe
        6⤵
        
        PID:4524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6404.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30110.exe
        6⤵
        
        PID:5208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        7⤵
        
        PID:7144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12469.exe
        8⤵
        
        PID:14896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55251.exe
        8⤵
        
        PID:16628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49085.exe
        7⤵
        
        PID:9876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57356.exe
        7⤵
        
        PID:13808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21733.exe
        7⤵
        
        PID:14652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28708.exe
        6⤵
        
        PID:7924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24631.exe
        6⤵
        
        PID:10800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26377.exe
        6⤵
        
        PID:13268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26881.exe
        6⤵
        
        PID:17656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41240.exe
        5⤵
        
        PID:5588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46078.exe
        6⤵
        
        PID:6876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57814.exe
        7⤵
        
        PID:9300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65193.exe
        7⤵
        
        PID:14048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40688.exe
        7⤵
        
        PID:15456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50155.exe
        7⤵
        
        PID:13800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49520.exe
        6⤵
        
        PID:10524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23061.exe
        6⤵
        
        PID:14880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48506.exe
        6⤵
        
        PID:17064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36825.exe
        5⤵
        
        PID:8120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16554.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33486.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17363.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1944.exe
        5⤵
        
        PID:2024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48117.exe
        5⤵
        
        PID:16556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12059.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12059.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38330.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37400.exe
        6⤵
        
        PID:640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26234.exe
        7⤵
        
        PID:4804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18220.exe
        8⤵
        
        PID:3156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49520.exe
        7⤵
        
        PID:10516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23061.exe
        7⤵
        
        PID:15312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5589.exe
        7⤵
        
        PID:4484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50228.exe
        6⤵
        
        PID:8096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54617.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18479.exe
        6⤵
        
        PID:14852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14430.exe
        6⤵
        
        PID:17936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65413.exe
        5⤵
        
        PID:5652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42186.exe
        6⤵
        
        PID:7136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32002.exe
        7⤵
        
        PID:9560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23008.exe
        7⤵
        
        PID:13720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59474.exe
        7⤵
        
        PID:15896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49085.exe
        6⤵
        
        PID:9660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44720.exe
        6⤵
        
        PID:13848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32475.exe
        6⤵
        
        PID:16708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38360.exe
        5⤵
        
        PID:7944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28806.exe
        6⤵
        
        PID:14708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15946.exe
        6⤵
        
        PID:17632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50917.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24727.exe
        5⤵
        
        PID:15268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40138.exe
        5⤵
        
        PID:17000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5392.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5392.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1713.exe
        5⤵
        
        PID:4184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9321.exe
        6⤵
        
        PID:7092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40746.exe
        7⤵
        
        PID:9468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38576.exe
        7⤵
        
        PID:13560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29681.exe
        7⤵
        
        PID:17644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16412.exe
        6⤵
        
        PID:9356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-179.exe
        6⤵
        
        PID:13692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17457.exe
        6⤵
        
        PID:2976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57297.exe
        5⤵
        
        PID:7808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56152.exe
        5⤵
        
        PID:10548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33393.exe
        5⤵
        
        PID:13716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39134.exe
        5⤵
        
        PID:17416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14703.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14703.exe
      4⤵
      PID:5776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40916.exe
        5⤵
        
        PID:8216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61965.exe
        5⤵
        
        PID:11308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29702.exe
        5⤵
        
        PID:16152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64717.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64717.exe
      4⤵
      PID:6648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64738.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64738.exe
      4⤵
      PID:2392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34427.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34427.exe
      4⤵
      PID:14472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36546.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36546.exe
      4⤵
      PID:4632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30316.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30316.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35538.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35538.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63306.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42606.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5029.exe
        7⤵
        
        PID:2552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54718.exe
        8⤵
        
        PID:6136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11633.exe
        9⤵
        
        PID:8456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6568.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:12008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2203.exe
        9⤵
        
        PID:15996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58987.exe
        9⤵
        
        PID:16360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53797.exe
        8⤵
        
        PID:8836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-615.exe
        8⤵
        
        PID:12392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50322.exe
        8⤵
        
        PID:16352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33072.exe
        7⤵
        
        PID:6464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5193.exe
        8⤵
        
        PID:9292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38384.exe
        8⤵
        
        PID:12972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24533.exe
        8⤵
        
        PID:15400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28803.exe
        7⤵
        
        PID:9476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12676.exe
        7⤵
        
        PID:12812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17649.exe
        7⤵
        
        PID:15592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47385.exe
        6⤵
        
        PID:2428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38102.exe
        7⤵
        
        PID:6256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9168.exe
        7⤵
        
        PID:10204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57164.exe
        7⤵
        
        PID:14064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58490.exe
        7⤵
        
        PID:14136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48012.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41100.exe
        7⤵
        
        PID:6048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38648.exe
        6⤵
        
        PID:12444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21153.exe
        6⤵
        
        PID:16296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31100.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34194.exe
        6⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38574.exe
        7⤵
        
        PID:2212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43338.exe
        8⤵
        
        PID:7700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63029.exe
        8⤵
        
        PID:10408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
        8⤵
        
        PID:15340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51883.exe
        8⤵
        
        PID:6616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33944.exe
        7⤵
        
        PID:7640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44040.exe
        7⤵
        
        PID:11900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39598.exe
        7⤵
        
        PID:3212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-748.exe
        6⤵
        
        PID:6892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24270.exe
        7⤵
        
        PID:9032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64477.exe
        7⤵
        
        PID:12612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30399.exe
        7⤵
        
        PID:13708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-407.exe
        6⤵
        
        PID:9360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57985.exe
        6⤵
        
        PID:12868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42154.exe
        6⤵
        
        PID:15096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21587.exe
        5⤵
        
        PID:5720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39254.exe
        6⤵
        
        PID:7728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63029.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15275.exe
        6⤵
        
        PID:13640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53087.exe
        6⤵
        
        PID:5468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45377.exe
        5⤵
        
        PID:7672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3331.exe
        6⤵
        
        PID:17664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41240.exe
        5⤵
        
        PID:11892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1693.exe
        5⤵
        
        PID:736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32340.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46498.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29232.exe
        6⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51322.exe
        7⤵
        
        PID:8196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50341.exe
        7⤵
        
        PID:11548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5135.exe
        7⤵
        
        PID:15932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58987.exe
        7⤵
        
        PID:16348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17371.exe
        6⤵
        
        PID:8612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-643.exe
        7⤵
        
        PID:4756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9640.exe
        6⤵
        
        PID:12172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21534.exe
        6⤵
        
        PID:14484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43841.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62030.exe
        6⤵
        
        PID:6784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24078.exe
        7⤵
        
        PID:9208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47949.exe
        7⤵
        
        PID:12780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6863.exe
        7⤵
        
        PID:14988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22999.exe
        7⤵
        
        PID:4172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6516.exe
        6⤵
        
        PID:9952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7527.exe
        6⤵
        
        PID:10308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13356.exe
        6⤵
        
        PID:15116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4733.exe
        6⤵
        
        PID:16800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15827.exe
        5⤵
        
        PID:7220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21058.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18732.exe
        6⤵
        
        PID:13872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33765.exe
        6⤵
        
        PID:17544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57165.exe
        5⤵
        
        PID:6904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36595.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61903.exe
        5⤵
        
        PID:6868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11779.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11779.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29918.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58693.exe
        6⤵
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12017.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39972.exe
        7⤵
        
        PID:12680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6863.exe
        7⤵
        
        PID:16352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58987.exe
        7⤵
        
        PID:14924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60516.exe
        6⤵
        
        PID:9228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57985.exe
        6⤵
        
        PID:13040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42154.exe
        6⤵
        
        PID:16312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17364.exe
        5⤵
        
        PID:8128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41240.exe
        5⤵
        
        PID:11876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31492.exe
        5⤵
        
        PID:15720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18179.exe
        5⤵
        
        PID:15356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3140.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3140.exe
      4⤵
      PID:5672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58854.exe
        5⤵
        
        PID:7668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29973.exe
        5⤵
        
        PID:13340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46038.exe
        5⤵
        
        PID:3716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13359.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13359.exe
      4⤵
      PID:7688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21832.exe
        5⤵
        
        PID:1672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24704.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24704.exe
      4⤵
      PID:11924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61895.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61895.exe
      4⤵
      PID:4988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13071.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13071.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51054.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51054.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-805.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44718.exe
        6⤵
        
        PID:3344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10945.exe
        7⤵
        
        PID:6280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50746.exe
        8⤵
        
        PID:12112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54005.exe
        8⤵
        
        PID:16008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44954.exe
        8⤵
        
        PID:16048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30252.exe
        7⤵
        
        PID:9088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14019.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58987.exe
        7⤵
        
        PID:15204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58588.exe
        6⤵
        
        PID:8032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59277.exe
        6⤵
        
        PID:10864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17711.exe
        6⤵
        
        PID:4020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27834.exe
        6⤵
        
        PID:18036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2460.exe
        5⤵
        
        PID:1744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13405.exe
        6⤵
        
        PID:7068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42194.exe
        7⤵
        
        PID:12188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20449.exe
        7⤵
        
        PID:15144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16412.exe
        6⤵
        
        PID:9332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36936.exe
        6⤵
        
        PID:13656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5495.exe
        5⤵
        
        PID:7824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20010.exe
        6⤵
        
        PID:15684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26470.exe
        6⤵
        
        PID:16872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55001.exe
        5⤵
        
        PID:10720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24727.exe
        5⤵
        
        PID:15236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27208.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27208.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5029.exe
        5⤵
        
        PID:2292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52798.exe
        6⤵
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58854.exe
        7⤵
        
        PID:7580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29973.exe
        7⤵
        
        PID:13332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19377.exe
        7⤵
        
        PID:16936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57881.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57984.exe
        6⤵
        
        PID:12460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58682.exe
        6⤵
        
        PID:15372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39320.exe
        5⤵
        
        PID:5408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19610.exe
        6⤵
        
        PID:8540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2100.exe
        6⤵
        
        PID:11588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58987.exe
        6⤵
        
        PID:16364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22799.exe
        5⤵
        
        PID:8352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60149.exe
        5⤵
        
        PID:13308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43882.exe
        5⤵
        
        PID:5356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41240.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41240.exe
      4⤵
      PID:5556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16914.exe
        5⤵
        
        PID:6740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65162.exe
        6⤵
        
        PID:10496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15520.exe
        6⤵
        
        PID:4160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26315.exe
        6⤵
        
        PID:15432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22852.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47652.exe
        5⤵
        
        PID:11916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1810.exe
        5⤵
        
        PID:14844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26353.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26353.exe
      4⤵
      PID:7000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32002.exe
        5⤵
        
        PID:9924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26759.exe
        5⤵
        
        PID:14696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53035.exe
        5⤵
        
        PID:17968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44416.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44416.exe
      4⤵
      PID:8572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51425.exe
      4⤵
      PID:14088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29321.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29321.exe
      4⤵
      PID:1588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26285.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26285.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14401.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14401.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54422.exe
        5⤵
        
        PID:712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15029.exe
        6⤵
        
        PID:6288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61078.exe
        7⤵
        
        PID:7316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28156.exe
        7⤵
        
        PID:13140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34969.exe
        7⤵
        
        PID:5416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34039.exe
        6⤵
        
        PID:9920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42609.exe
        6⤵
        
        PID:13728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30965.exe
        6⤵
        
        PID:17432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50717.exe
        5⤵
        
        PID:6212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42926.exe
        6⤵
        
        PID:13048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24341.exe
        6⤵
        
        PID:4800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43324.exe
        5⤵
        
        PID:10076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5660.exe
        5⤵
        
        PID:13960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36253.exe
        5⤵
        
        PID:5324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30664.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30664.exe
      4⤵
      PID:5148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16914.exe
        5⤵
        
        PID:6800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32298.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64913.exe
        6⤵
        
        PID:2192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6516.exe
        5⤵
        
        PID:9944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11611.exe
        5⤵
        
        PID:10280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49345.exe
        5⤵
        
        PID:14820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21733.exe
        5⤵
        
        PID:14760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58204.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58204.exe
      4⤵
      PID:7428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42770.exe
        5⤵
        
        PID:11820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61482.exe
        5⤵
        
        PID:14636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17476.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17476.exe
      4⤵
      PID:10288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15791.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15791.exe
      4⤵
      PID:14716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59443.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59443.exe
      4⤵
      PID:4396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33867.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33867.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54422.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54422.exe
      4⤵
      PID:1428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15029.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28162.exe
        6⤵
        
        PID:9188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56361.exe
        7⤵
        
        PID:15436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42459.exe
        7⤵
        
        PID:11944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52033.exe
        6⤵
        
        PID:12752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6863.exe
        6⤵
        
        PID:16368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19106.exe
        6⤵
        
        PID:1452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22084.exe
        5⤵
        
        PID:9024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5851.exe
        5⤵
        
        PID:12388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26315.exe
        5⤵
        
        PID:15156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58588.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58588.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48448.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48448.exe
      4⤵
      PID:11532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9728.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9728.exe
      4⤵
      PID:15420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33405.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33405.exe
      4⤵
      PID:14848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41784.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41784.exe
    3⤵
    PID:384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33250.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33250.exe
      4⤵
      PID:6716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33310.exe
        5⤵
        
        PID:9812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43620.exe
        5⤵
        
        PID:13816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9261.exe
        5⤵
        
        PID:18136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51825.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51825.exe
      4⤵
      PID:9772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47652.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47652.exe
      4⤵
      PID:12468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26315.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26315.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:15444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13557.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13557.exe
    3⤵
    PID:7212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18266.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18266.exe
      4⤵
      PID:11840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54005.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54005.exe
      4⤵
      PID:16024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49038.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49038.exe
      4⤵
      PID:16136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56087.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56087.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:9164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30680.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30680.exe
    3⤵
    PID:14728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22234.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22234.exe
    3⤵
    PID:18176
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55641.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55641.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65366.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65366.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51874.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51874.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38802.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13441.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48226.exe
        7⤵
        
        PID:3908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31174.exe
        8⤵
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65494.exe
        9⤵
        
        PID:8876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44249.exe
        9⤵
        
        PID:12504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58987.exe
        9⤵
        
        PID:1740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34039.exe
        8⤵
        
        PID:9944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9744.exe
        8⤵
        
        PID:13916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29237.exe
        8⤵
        
        PID:16884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1324.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19994.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47949.exe
        8⤵
        
        PID:12768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36211.exe
        8⤵
        
        PID:7008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13235.exe
        7⤵
        
        PID:10196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50201.exe
        7⤵
        
        PID:13424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12901.exe
        7⤵
        
        PID:5876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16108.exe
        6⤵
        
        PID:4108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8257.exe
        7⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13789.exe
        8⤵
        
        PID:7292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65162.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:10052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44493.exe
        9⤵
        
        PID:14892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51498.exe
        9⤵
        
        PID:16424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42504.exe
        8⤵
        
        PID:10932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18976.exe
        8⤵
        
        PID:15144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50315.exe
        8⤵
        
        PID:15632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4780.exe
        7⤵
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1471.exe
        7⤵
        
        PID:9412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
        7⤵
        
        PID:15108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25618.exe
        7⤵
        
        PID:16228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6595.exe
        6⤵
        
        PID:6036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19802.exe
        7⤵
        
        PID:8408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14736.exe
        7⤵
        
        PID:11968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26315.exe
        7⤵
        
        PID:13856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7860.exe
        6⤵
        
        PID:8788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59268.exe
        6⤵
        
        PID:12424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18179.exe
        6⤵
        
        PID:15368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46477.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16322.exe
        6⤵
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53566.exe
        7⤵
        
        PID:5608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15525.exe
        8⤵
        
        PID:8512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39048.exe
        8⤵
        
        PID:11932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30399.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57549.exe
        7⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24912.exe
        7⤵
        
        PID:15172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53120.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36004.exe
        6⤵
        
        PID:6364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44690.exe
        7⤵
        
        PID:9092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23252.exe
        7⤵
        
        PID:12700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6863.exe
        7⤵
        
        PID:16376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19298.exe
        7⤵
        
        PID:2028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3147.exe
        6⤵
        
        PID:9152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57985.exe
        6⤵
        
        PID:13100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50322.exe
        6⤵
        
        PID:16368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2599.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2201.exe
        6⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55162.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9220.exe
        7⤵
        
        PID:12204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13724.exe
        6⤵
        
        PID:6624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24543.exe
        6⤵
        
        PID:12844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44422.exe
        6⤵
        
        PID:15808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8288.exe
        5⤵
        
        PID:6832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14519.exe
        5⤵
        
        PID:10172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25000.exe
        5⤵
        
        PID:13452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20099.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30996.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30996.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45730.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19446.exe
        6⤵
        
        PID:5040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53566.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58265.exe
        8⤵
        
        PID:8444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54284.exe
        8⤵
        
        PID:13300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44230.exe
        8⤵
        
        PID:16764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61668.exe
        7⤵
        
        PID:9576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28821.exe
        7⤵
        
        PID:13280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56674.exe
        7⤵
        
        PID:16648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36004.exe
        6⤵
        
        PID:6392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35178.exe
        7⤵
        
        PID:8228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9308.exe
        7⤵
        
        PID:11580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50819.exe
        7⤵
        
        PID:16176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27267.exe
        6⤵
        
        PID:8272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27669.exe
        6⤵
        
        PID:12992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59443.exe
        6⤵
        
        PID:3300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56949.exe
        5⤵
        
        PID:2608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65434.exe
        6⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62938.exe
        7⤵
        
        PID:7616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52630.exe
        8⤵
        
        PID:13124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1285.exe
        8⤵
        
        PID:16964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30304.exe
        7⤵
        
        PID:11984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10441.exe
        7⤵
        
        PID:4116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15591.exe
        6⤵
        
        PID:8936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61109.exe
        6⤵
        
        PID:11628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6165.exe
        6⤵
        
        PID:4588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57524.exe
        5⤵
        
        PID:5744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22542.exe
        6⤵
        
        PID:8328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9308.exe
        6⤵
        
        PID:11444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26315.exe
        6⤵
        
        PID:10756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33325.exe
        5⤵
        
        PID:7248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21743.exe
        5⤵
        
        PID:12860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60364.exe
        5⤵
        
        PID:1880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60212.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60212.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12237.exe
        5⤵
        
        PID:3800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53566.exe
        6⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18458.exe
        7⤵
        
        PID:8340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42364.exe
        7⤵
        
        PID:11332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42276.exe
        7⤵
        
        PID:15896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1810.exe
        7⤵
        
        PID:6164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57549.exe
        6⤵
        
        PID:6108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24912.exe
        6⤵
        
        PID:15276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8003.exe
        6⤵
        
        PID:17104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36004.exe
        5⤵
        
        PID:6384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65494.exe
        6⤵
        
        PID:9080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23252.exe
        6⤵
        
        PID:12692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44370.exe
        6⤵
        
        PID:18108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60516.exe
        5⤵
        
        PID:9248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57985.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58682.exe
        5⤵
        
        PID:15512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61941.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61941.exe
      4⤵
      PID:1552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10945.exe
        5⤵
        
        PID:6260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27534.exe
        6⤵
        
        PID:10152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30600.exe
        6⤵
        
        PID:13444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28583.exe
        6⤵
        
        PID:16440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29955.exe
        5⤵
        
        PID:9508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23959.exe
        5⤵
        
        PID:14664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42146.exe
        5⤵
        
        PID:13264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61652.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61652.exe
      4⤵
      PID:6216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32932.exe
        5⤵
        
        PID:5348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28072.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28072.exe
      4⤵
      PID:10048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1609.exe
      4⤵
      PID:13924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5881.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5881.exe
      4⤵
      PID:18088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23840.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23840.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26742.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26742.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28818.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51734.exe
        6⤵
        
        PID:4872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9409.exe
        7⤵
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19610.exe
        8⤵
        
        PID:8520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6376.exe
        8⤵
        
        PID:12108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50819.exe
        8⤵
        
        PID:16184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57549.exe
        7⤵
        
        PID:9268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53834.exe
        8⤵
        
        PID:15396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29210.exe
        8⤵
        
        PID:16728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10591.exe
        7⤵
        
        PID:14072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59020.exe
        7⤵
        
        PID:13976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57385.exe
        6⤵
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45318.exe
        7⤵
        
        PID:11552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19412.exe
        7⤵
        
        PID:15192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31359.exe
        7⤵
        
        PID:424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24719.exe
        6⤵
        
        PID:9500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63684.exe
        6⤵
        
        PID:14232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52391.exe
        6⤵
        
        PID:17128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23316.exe
        5⤵
        Executes dropped EXE
        
        PID:1776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48330.exe
        6⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45886.exe
        7⤵
        
        PID:6820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65494.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56012.exe
        8⤵
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34483.exe
        8⤵
        
        PID:15412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52209.exe
        7⤵
        
        PID:9368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52120.exe
        7⤵
        
        PID:12728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46735.exe
        7⤵
        
        PID:15496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9056.exe
        6⤵
        
        PID:8136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20163.exe
        6⤵
        
        PID:11084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33786.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10679.exe
        5⤵
        
        PID:2480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40598.exe
        6⤵
        
        PID:7788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5468.exe
        6⤵
        
        PID:10472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27527.exe
        6⤵
        
        PID:15184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53035.exe
        6⤵
        
        PID:18048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51441.exe
        5⤵
        
        PID:5116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65064.exe
        6⤵
        
        PID:16088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32687.exe
        5⤵
        
        PID:12252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63781.exe
        5⤵
        
        PID:15860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27412.exe
        5⤵
        
        PID:17916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16928.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2341.exe
        5⤵
        
        PID:3308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26758.exe
        6⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21190.exe
        7⤵
        
        PID:6344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55162.exe
        8⤵
        
        PID:9628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17091.exe
        8⤵
        
        PID:14280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50201.exe
        7⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46064.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-378.exe
        7⤵
        
        PID:2800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44748.exe
        6⤵
        
        PID:7940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49905.exe
        6⤵
        
        PID:11960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48028.exe
        6⤵
        
        PID:15696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33786.exe
        6⤵
        
        PID:14992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3768.exe
        5⤵
        
        PID:5768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        6⤵
        
        PID:7156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42194.exe
        7⤵
        
        PID:12292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37284.exe
        7⤵
        
        PID:16108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44954.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49085.exe
        6⤵
        
        PID:9676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4036.exe
        6⤵
        
        PID:14780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23461.exe
        6⤵
        
        PID:3952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42444.exe
        5⤵
        
        PID:7896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16346.exe
        6⤵
        
        PID:11852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52085.exe
        6⤵
        
        PID:15612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5702.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30497.exe
        5⤵
        
        PID:10816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17711.exe
        5⤵
        
        PID:1700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63335.exe
        5⤵
        
        PID:4092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45412.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45412.exe
      4⤵
      PID:4076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49098.exe
        5⤵
        
        PID:5300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46602.exe
        6⤵
        
        PID:7236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50554.exe
        7⤵
        
        PID:11336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44954.exe
        7⤵
        
        PID:16340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29973.exe
        6⤵
        
        PID:13376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14326.exe
        6⤵
        
        PID:1616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3636.exe
        5⤵
        
        PID:8596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3775.exe
        5⤵
        
        PID:10680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21733.exe
        5⤵
        
        PID:780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51137.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51137.exe
      4⤵
      PID:4492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19994.exe
        5⤵
        
        PID:8256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47949.exe
        5⤵
        
        PID:12788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6863.exe
        5⤵
        
        PID:16360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32127.exe
        5⤵
        
        PID:5684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24659.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24659.exe
      4⤵
      PID:7716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2468.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2468.exe
      4⤵
      PID:13000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42917.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42917.exe
      4⤵
      PID:15396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61644.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61644.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4121.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4121.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20022.exe
        5⤵
        
        PID:768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30768.exe
        6⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50686.exe
        7⤵
        
        PID:7856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3331.exe
        8⤵
        
        PID:16404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21803.exe
        7⤵
        
        PID:13016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16985.exe
        7⤵
        
        PID:16840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1995.exe
        6⤵
        
        PID:8796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26901.exe
        6⤵
        
        PID:12352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1114.exe
        6⤵
        
        PID:2024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33124.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28922.exe
        6⤵
        
        PID:8152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46336.exe
        7⤵
        
        PID:16456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47461.exe
        6⤵
        
        PID:11168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13111.exe
        6⤵
        
        PID:15228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58490.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45576.exe
        5⤵
        
        PID:3096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34026.exe
        6⤵
        
        PID:11980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61482.exe
        6⤵
        
        PID:15192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25017.exe
        5⤵
        
        PID:12276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28424.exe
        5⤵
        
        PID:16744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61609.exe
      4⤵
      PID:5048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2253.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5045.exe
        6⤵
        
        PID:6228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36974.exe
        7⤵
        
        PID:14672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54047.exe
        7⤵
        
        PID:18292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29588.exe
        6⤵
        
        PID:10060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10423.exe
        6⤵
        
        PID:14736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15126.exe
        6⤵
        
        PID:18256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20540.exe
        5⤵
        
        PID:7964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12380.exe
        5⤵
        
        PID:11460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30347.exe
        5⤵
        
        PID:15372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64448.exe
        5⤵
        
        PID:428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17503.exe
      4⤵
      PID:5760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17106.exe
        5⤵
        
        PID:6732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51462.exe
        6⤵
        
        PID:9312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38384.exe
        6⤵
        
        PID:12964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4113.exe
        6⤵
        
        PID:1896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-703.exe
        5⤵
        
        PID:10480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23061.exe
        5⤵
        
        PID:15296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56667.exe
        5⤵
        
        PID:16904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3192.exe
      4⤵
      PID:7868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53352.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53352.exe
      4⤵
      PID:10532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61477.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61477.exe
      4⤵
      PID:13688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19907.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19907.exe
      4⤵
      PID:16968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58485.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58485.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32082.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32082.exe
      4⤵
      PID:3560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44246.exe
        5⤵
        
        PID:5924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38102.exe
        6⤵
        
        PID:6564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31218.exe
        7⤵
        
        PID:16268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47170.exe
        7⤵
        
        PID:18096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33480.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5223.exe
        6⤵
        
        PID:14036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64022.exe
        6⤵
        
        PID:5128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20540.exe
        5⤵
        
        PID:7972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5495.exe
        6⤵
        
        PID:16536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12380.exe
        5⤵
        
        PID:11448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30347.exe
        5⤵
        
        PID:15364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47920.exe
        5⤵
        
        PID:15704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42444.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42444.exe
      4⤵
      PID:6056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11441.exe
        5⤵
        
        PID:8552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6376.exe
        5⤵
        
        PID:12080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58987.exe
        5⤵
        
        PID:4296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6079.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6079.exe
      4⤵
      PID:8852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63849.exe
      4⤵
      PID:12452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33035.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33035.exe
      4⤵
      PID:16164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42146.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42146.exe
      4⤵
      PID:10764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10899.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10899.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27718.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27718.exe
      4⤵
      PID:5728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9321.exe
        5⤵
        
        PID:7084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15666.exe
        6⤵
        
        PID:9600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18924.exe
        6⤵
        
        PID:13748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13398.exe
        6⤵
        
        PID:6408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16412.exe
        5⤵
        
        PID:9344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36936.exe
        5⤵
        
        PID:13648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54406.exe
        5⤵
        
        PID:1920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57297.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57297.exe
      4⤵
      PID:7816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52068.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52068.exe
      4⤵
      PID:10580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29309.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29309.exe
      4⤵
      PID:15196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27545.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27545.exe
      4⤵
      PID:5216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56497.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56497.exe
    3⤵
    PID:6100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21958.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21958.exe
      4⤵
      PID:7260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37564.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37564.exe
      4⤵
      PID:10252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55732.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55732.exe
      4⤵
      PID:14508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1810.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1810.exe
      4⤵
      PID:6520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28114.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28114.exe
    3⤵
    PID:7124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7219.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7219.exe
    3⤵
    PID:11504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4012.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4012.exe
    3⤵
    PID:15292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42443.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42443.exe
    3⤵
    PID:2052
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52220.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52220.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34312.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34312.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19726.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19726.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27230.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53566.exe
        6⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19610.exe
        7⤵
        
        PID:8528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21214.exe
        8⤵
        
        PID:13864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54047.exe
        8⤵
        
        PID:18268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47409.exe
        7⤵
        
        PID:12192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26315.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57549.exe
        6⤵
        
        PID:6012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2423.exe
        6⤵
        
        PID:14080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9965.exe
        6⤵
        
        PID:17452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36004.exe
        5⤵
        
        PID:6376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65494.exe
        6⤵
        
        PID:8892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56012.exe
        6⤵
        
        PID:13804
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13804 -s 436
        7⤵
        Program crash
        
        PID:15836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1810.exe
        6⤵
        
        PID:4112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3147.exe
        5⤵
        
        PID:8380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57985.exe
        5⤵
        
        PID:13012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58490.exe
        5⤵
        
        PID:4520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60649.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60649.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44246.exe
        5⤵
        
        PID:5916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62030.exe
        6⤵
        
        PID:6792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17254.exe
        7⤵
        
        PID:3960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60009.exe
        7⤵
        
        PID:12912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50819.exe
        7⤵
        
        PID:16300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14684.exe
        6⤵
        
        PID:9904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47652.exe
        6⤵
        
        PID:12324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50819.exe
        6⤵
        
        PID:16168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2092.exe
        5⤵
        
        PID:7252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51300.exe
        5⤵
        
        PID:10244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61597.exe
        5⤵
        
        PID:14476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5397.exe
        5⤵
        
        PID:6508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46860.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46860.exe
      4⤵
      PID:5960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21530.exe
        5⤵
        
        PID:3316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38384.exe
        5⤵
        
        PID:12936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7533.exe
        5⤵
        
        PID:16660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23237.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23237.exe
      4⤵
      PID:8604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46278.exe
        5⤵
        
        PID:12120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53122.exe
        5⤵
        
        PID:3372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-975.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-975.exe
      4⤵
      PID:12212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59212.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59212.exe
      4⤵
      PID:13796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1343.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1343.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14977.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14977.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7297.exe
        5⤵
        
        PID:5852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44853.exe
        6⤵
        
        PID:8044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53412.exe
        6⤵
        
        PID:10848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26377.exe
        6⤵
        
        PID:1784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39134.exe
        6⤵
        
        PID:17704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11988.exe
        5⤵
        
        PID:8008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8296.exe
        5⤵
        
        PID:11488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30347.exe
        5⤵
        
        PID:13856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9819.exe
        5⤵
        
        PID:2416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33124.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33124.exe
      4⤵
      PID:5824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4396.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7881.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64425.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33765.exe
        6⤵
        
        PID:17492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52068.exe
        5⤵
        
        PID:10588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33393.exe
        5⤵
        
        PID:13740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45574.exe
        5⤵
        
        PID:17084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26683.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26683.exe
      4⤵
      PID:7056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7336.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7336.exe
      4⤵
      PID:10796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55428.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55428.exe
      4⤵
      PID:14916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1843.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1843.exe
      4⤵
      PID:15108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6544.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6544.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52030.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52030.exe
      4⤵
      PID:6060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26042.exe
        5⤵
        
        PID:7184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-616.exe
        5⤵
        
        PID:9644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59816.exe
        5⤵
        
        PID:14764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22230.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57297.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57297.exe
      4⤵
      PID:7832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60700.exe
        5⤵
        
        PID:17724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36885.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36885.exe
      4⤵
      PID:11516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26263.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26263.exe
      4⤵
      PID:15408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18179.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18179.exe
      4⤵
      PID:5692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7879.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7879.exe
    3⤵
    PID:6128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24070.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24070.exe
      4⤵
      PID:7768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21804.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21804.exe
      4⤵
      PID:10444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7107.exe
      4⤵
      PID:15256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62599.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62599.exe
      4⤵
      PID:16596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28344.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28344.exe
    3⤵
    PID:7632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41770.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41770.exe
    3⤵
    PID:11936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37314.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37314.exe
    3⤵
    PID:4064
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23021.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23021.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10021.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10021.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55050.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55050.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37400.exe
        5⤵
        
        PID:3776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61765.exe
        6⤵
        
        PID:7280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31019.exe
        6⤵
        
        PID:11432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39013.exe
        6⤵
        
        PID:1896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33611.exe
        6⤵
        
        PID:15728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40714.exe
        6⤵
        
        PID:2596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2371.exe
        5⤵
        
        PID:8188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1332.exe
        5⤵
        
        PID:9620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9543.exe
        5⤵
        
        PID:14496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10346.exe
        5⤵
        
        PID:18016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51817.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51817.exe
      4⤵
      PID:5616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4417.exe
        5⤵
        
        PID:6360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61441.exe
        5⤵
        
        PID:10056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58228.exe
        5⤵
        
        PID:14944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61447.exe
        5⤵
        
        PID:16408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22983.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22983.exe
      4⤵
      PID:7552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8296.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8296.exe
      4⤵
      PID:11472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26263.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26263.exe
      4⤵
      PID:15400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27412.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27412.exe
      4⤵
      PID:17688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63581.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63581.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34194.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34194.exe
      4⤵
      PID:5164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        5⤵
        
        PID:5868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37394.exe
        6⤵
        
        PID:9896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30984.exe
        6⤵
        
        PID:13840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40206.exe
        6⤵
        
        PID:16944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49085.exe
        5⤵
        
        PID:10328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19551.exe
        5⤵
        
        PID:15148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32127.exe
        5⤵
        
        PID:2796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44748.exe
      4⤵
      PID:7984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49905.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49905.exe
      4⤵
      PID:11972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23223.exe
      4⤵
      PID:4604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1167.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1167.exe
    3⤵
    PID:5832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13021.exe
      4⤵
      PID:6632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1109.exe
        5⤵
        
        PID:9256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38384.exe
        5⤵
        
        PID:12908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29681.exe
        5⤵
        
        PID:17900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7668.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7668.exe
      4⤵
      PID:10164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44336.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44336.exe
      4⤵
      PID:13460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32127.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32127.exe
      4⤵
      PID:1604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3192.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3192.exe
    3⤵
    PID:7876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25916.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25916.exe
      4⤵
      PID:16808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46336.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46336.exe
    3⤵
    PID:10688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4108.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4108.exe
    3⤵
    PID:15320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42684.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42684.exe
    3⤵
    PID:16212
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50292.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50292.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5849.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5849.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22326.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22326.exe
      4⤵
      PID:620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64998.exe
        5⤵
        
        PID:6556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35812.exe
        6⤵
        
        PID:18124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15068.exe
        5⤵
        
        PID:9484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6811.exe
        5⤵
        
        PID:12748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1810.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17468.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17468.exe
      4⤵
      PID:6856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3849.exe
        5⤵
        
        PID:8404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15939.exe
        5⤵
        
        PID:13356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23.exe
      4⤵
      PID:9760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53517.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53517.exe
      4⤵
      PID:12408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17649.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17649.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65413.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65413.exe
    3⤵
    PID:5660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26042.exe
      4⤵
      PID:7176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16596.exe
        5⤵
        
        PID:17116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-616.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-616.exe
      4⤵
      PID:9028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25259.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25259.exe
      4⤵
      PID:14264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1121.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1121.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6455.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6455.exe
    3⤵
    PID:8172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1332.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1332.exe
    3⤵
    PID:9288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25687.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25687.exe
    3⤵
    PID:14552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27834.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27834.exe
    3⤵
    PID:18056
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25500.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25500.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45272.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45272.exe
    3⤵
    PID:212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65162.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65162.exe
      4⤵
      PID:3632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28156.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28156.exe
      4⤵
      PID:13364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47170.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47170.exe
      4⤵
      PID:17948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33325.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33325.exe
    3⤵
    PID:3368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21743.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21743.exe
    3⤵
    PID:12852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50852.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50852.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:16120
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64434.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64434.exe
  2⤵
  PID:5844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63374.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63374.exe
    3⤵
    PID:6248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49520.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49520.exe
    3⤵
    PID:10508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23061.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23061.exe
    3⤵
    PID:15332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30965.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30965.exe
    3⤵
    PID:17472
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39831.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39831.exe
  2⤵
  PID:7228
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54016.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54016.exe
  2⤵
  PID:11296
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20848.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20848.exe
  2⤵
  PID:14704
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7906.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7906.exe
  2⤵
  PID:1460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 13804 -ip 13804
1⤵
PID:15780

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:14656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10021.exe

Filesize
468KB

MD5
bee71e47aa7d2fad32dc531a96a2f343

SHA1
ffbdcb4a4bbd013cfde8b78f6eabd338d259aa4b

SHA256
5871f41f81b8cdc888ec92d8e964cd660f79c385fecf231b1f0349c69363176f

SHA512
156f2641dec0c15d7d9b75e3fdccb7051d7b17d630c2a7864dbe3792d3e4e99b3f3f39fcf8aaeff2e5ac46b4ff03df5d5642b4b5cad8076f3004790534a94df3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11977.exe

Filesize
468KB

MD5
7804fa8e0c6a5076a6aca70315e6a01e

SHA1
13a990982a385daba41be37f39cd126bfbdbf4a3

SHA256
3c90097862905619b1a6662d0e54be599edf535b65ec9ff825b94441de88f9c1

SHA512
909778e60438432a3a147fc3637fead85c0c2de0a1612730de1fc33e708e9c9138ed07b7b1596ecc2decc37464c3a067cc3f9f474ed44915615bec43c00de2f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12059.exe

Filesize
468KB

MD5
7d336635aada0af98907d94cb844ff78

SHA1
85c29396344f6706fb7db478f42d578729d37de8

SHA256
0d98bf421e07740e0f899461f66f9d5bcdbd8994dcba56e029217705946ef9ea

SHA512
74c7e96ef52656660265f1f9d99e215418de275b177b4c11f95c302b3c47b3bafbf67057e141346cc72daf1fa72bca4b4ce8aa82999cd0c8e26af15827c74161

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13071.exe

Filesize
468KB

MD5
a088a2fe225093e4ffe7f3545a3f0978

SHA1
2f9b3f286fd3fd1fca22adce7c4cc1681dca17f5

SHA256
8363745e25fbb44b9967e8ce82e31fa2866442bfd3993be75c5c553326b4de8f

SHA512
94f7cfa00d7898703b42af562a7091459b9132f0142b5611258fc02357099d095290a7e3d26b89e9740c27524a9246ee2180ed72a81e2fa4e09053c1e4642e2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1343.exe

Filesize
468KB

MD5
fb0634814e56b2400ea830d7895734b5

SHA1
c66b211ccc8655208b592788af827347ec7a8bfa

SHA256
d7a04aee3276190c842917a2f96f753d889ed321a543d3285705a4b98433da07

SHA512
5b574e9c5bb758a5dd77696e3fcddee8dddf3a5a64da1b08205c88a2bb113ad2568f56603ef00153a4ab878e2d2fd596bd03d4ef4f452d9a65f87e8d56e5a014

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18138.exe

Filesize
468KB

MD5
845523f2fb42f49eb839c9b7bd422e46

SHA1
b5cc1c56f89160f0ac849e80f8ed54c74b636176

SHA256
de76912ec9da984ac5b72740a398a976b9c49776b7bc974e58d4e646477084a4

SHA512
4cc9d5c5cb16c5b5cfa0557fdf399debb4f00cb427dee36918e8d63e8e24538e2d7dd29874a6c1017fbb078d5045789131f21dc9292c29dcdca5c5e208076d80

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1853.exe

Filesize
468KB

MD5
9b0dafd61fa4e7848abf81970a84ba54

SHA1
6a77e48ff686249b3aa14c2a407cd7c1e85b7068

SHA256
0d87c1f12a4ba6ce74a9592e77bb6aa711c2acf90ed4c629e378621e159ec16c

SHA512
8080672b1847b97aadc560e7ab086e1499f722b887ab9c1edeb7b75e455f5ce0b4243033db1c4326018972859515f93b79547613c21916e1dba2381c9133204c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19726.exe

Filesize
468KB

MD5
ed58f3e60ffe645637db05ed05884481

SHA1
75dfe7175155094ddcb4a742af940394dcb4ff0f

SHA256
8c9950102da8380b465e19c8674a040d5ca64bf7eeb8c29933cc94e1ed9b43a6

SHA512
ad1148e1382546d6d50a802e5496714147e735cc881bcf79a1600ccc229fe916713a1807224918360cfd930ec2236c3b440956997e54d9ad71ad3b03dcc1f4a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23021.exe

Filesize
468KB

MD5
4e3300e95e2e55224061d780af3fb371

SHA1
95e6648723e7bfd787af903cc9375dd7d7d23d40

SHA256
841a45095c5a7cb6d464e51a1baae15b01d55b204efbff787a1a337d8b19868a

SHA512
77ab4f208e418cf2c573453fa45150ebff069c48a1a8267badbd12c3bbb8998ecd40aa908317e6328cd2e76d032ab902b9244e259777e57e62ee8f97f8fe7899

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23286.exe

Filesize
468KB

MD5
e7a83ef7cb9b13354671d26f49c1b446

SHA1
ecdab47fa152cd5954e3dc496b20755309c39bfc

SHA256
e203d965f84f6d4da30e69f92ca613f0332cf1f5bfeb5660ecdd5ba7b17694d6

SHA512
6f7d0a4fc66e6b2bde8485783a9f89dbe4a749cdf79700a18116ce1733b8fdf75ea2a1a42776c204c977eb1797f758aa3375dd515cb7bdd5be8f2bdc5ec6f9eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23840.exe

Filesize
468KB

MD5
c2f893745bf53812cc37cfbb221af54a

SHA1
6912c9ad684c6ad8d7d8eafc7bb8b83c7d865be9

SHA256
8959161812ce3e9e26304aeca9dae8dc5b0bb94fb2f6dce3be95940c3d402cd2

SHA512
0e21ee058f80e5dc6cb73ea13111526b4fd63dc4b9fbff10052830995c3453300a6270f090c3eccfbc6d32a39068287bc05e9c7576c7ee90d109b26a686b7f00

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26285.exe

Filesize
468KB

MD5
d77a8663014368cceaf1c47fc383d03b

SHA1
d1d2f33f55da8e234a2feee278b20cc9464670f0

SHA256
60f8b947b9b64b26c6ddb213a6970ee95eac7c43dad36fcfd70e48f7daeee7fe

SHA512
508b98c568e9afa559bace49565f1c77cae1bfa26c31f1a8468cbff8abef2a67dfd43f7097e6dc9f9c5cd4804b1c144deb418b474f152c3ce39ecd86e3019b74

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26358.exe

Filesize
468KB

MD5
1d91d9ccdece7e31ce87bb78fe98eb0f

SHA1
f22f13786f5c7b3bd1359e660b37b3f799694ea8

SHA256
4a169aaa3cb7076c3086e3c8b47ad8eeaf46fe561effaa47516ee5c97d732db8

SHA512
12356bcf4263cec7e3fafd0031f4e0bdc18aafb39e34e93a1d02229aba1003f5452ac510d092238cef1d9ba0078f37f60ea2995ee7a2811f85a68c1edfd7c2f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26742.exe

Filesize
468KB

MD5
2d7f356d8a83a45e3e21edc475d82e4a

SHA1
c3e64281ca6dab980a0e48af25e744b263c14eb1

SHA256
3334b1eb6bbd283fbdaa6429dd4fd16d3a9c4b2a73c8f8f5ff410fa20befa339

SHA512
79abf7c3092521b9b564ce9b9535cff0cf6bcbde4c0503e6b6458e7eea2c82e661f0c4cd628a7b3715ed9216244de425e8cda3eb882d9f02d45f36496913f784

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28818.exe

Filesize
468KB

MD5
0fa13cab49ff8420b5cc9a650c7d7c0b

SHA1
613819a42f031bee247583a9dc2efd5199b46a40

SHA256
b54ae00d48f0caceb52d965bf1dd401223a132c89561f695ba760e27c65426b8

SHA512
88e1b9006fb04f7e403e2b8f494ced7c59f4cedbdcd91d4773a8b95cca4fbbccafcd643b97af33fbfd08579f656a2a1bc3471a1ac7aa75aca86bdb263f95df34

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30316.exe

Filesize
468KB

MD5
2268587ef3279e6068e63539f2f775e0

SHA1
f62f38e0763ec497319ed75c786650f5e95e2314

SHA256
b0160d29fe4c31f0b649f47e1793e8189427859a852c9882533a77bf60079cb1

SHA512
b243cbf47ec2b4517c68d12afd3223ddefca73726d8658ca2cf7a5b0223e7aa7d4e98a7994df54623bb34a9eff0f50bbfe378281fb6c616057568b7a34a3b321

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30996.exe

Filesize
468KB

MD5
9e631cc454507f2416dcb0911b841400

SHA1
8c6359d4b05874561a6c367a3f3f1e1cdbd6b5c0

SHA256
f032f06c0b0955d6c65a365be89fb1e45ed9f54f1b4ffc5fa5009c8350c1e2eb

SHA512
1a4796881ad77749722170e4c4cd14a593f687291e5450524c54521d94ddf3f4d344337d9c74ae2e9a2fc66581d8fc90f5548dc9b9d74decb2eb9317a3fdb03e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32340.exe

Filesize
468KB

MD5
bbda0c046a675d90384c5e7edb17d020

SHA1
9991d6f60782e787c63d18958b47450e1fe9d1ff

SHA256
6fd62887ee217e8741f6c52656ad4e6845175369ddb51af0fbe3329f6c36fe1c

SHA512
2f116cd485735366752a5c5e72b75f23c407ad9e4e578409cea1b6ac0eb9cc040d9ae5c5bfd46f65821a9990fcbfa60cbf4afa26e916d38a3d7a5cc018433813

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3420.exe

Filesize
468KB

MD5
415bb990f9adf8d11b4371d5eb0485ac

SHA1
b8697462b7c00759610ebab89c4be76cc9733dd9

SHA256
0e91820c6b5dcd8b5e325123048265bae3a65fee0fa384ee00b94881d9aaacdd

SHA512
efca012bf89977b8b999dd160f28fd613b9e28ea0a0be58e050a68d912b1c9ef43737037ad3813b2dc2602cee7029f0026e7ce752eaa0db4c0c0461666b1c774

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34312.exe

Filesize
468KB

MD5
ef2ea3949fb4e585dcb67564bdf59af5

SHA1
6beaa62170b0f1f74404304e3e30bc457a45699a

SHA256
94f9a4ca6569f3ccd16a366686ec31f24c8d93a0ad3302c5d7da060865053dc4

SHA512
33df934fa21cd0719a8c3f9884239b658736a71ded7097453cb33187ca0c4a8195252d6e8f9d7040b25e155801aec3dd1f262ba124b1348e5d9b195e1e3e427a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35538.exe

Filesize
468KB

MD5
d09e4637788e20ea0f3437b995252f31

SHA1
bdacf341748372ec9c6e51af1a3945f21bc30f34

SHA256
b820e4521df84bd55b64af6caa55b374687ff7f2a3d31ca380b9d1c934a6b500

SHA512
2aae2926948df51068c2b51ac8234e21ac8eb75ffbabd8e27e59573a058db4c0378d212951e12408017a483b29e5f213b9aa7704529f79390ab9ab884f905313

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38802.exe

Filesize
468KB

MD5
7cf8a7465716d6562083f2be6cac72cb

SHA1
8cb8b9b6f4acb9b7dbcaf385e41ca671df703c63

SHA256
82d12af3616e1f4c0e77db04446a9ae7e700a474cbe6a7ebff121a13fd6bcaaa

SHA512
5eef659522656bc14fb3e45027a671b28da62a661b413bd8198f5b85bf2e43592f8728602973a89d5585809189a26c9fedb66606551c64849b4ca86fd72a586a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50292.exe

Filesize
468KB

MD5
71925cedc3295e26b8a7b0b8c50ec197

SHA1
e377fe5f541deb7e5271ce3e298dcb758570fb3c

SHA256
cc28f355d3caa5beacc0357264d8c2337aef459a594ec59bf069e8e5d0dd7824

SHA512
c8b268b6b5cfdee7d37bc2d697cb25a03f3ae98eb76e2b2651a646a7733b35b0208b195edf443facbd22dc1a4b117b93bd3eb5d0a0f639ab19005a35816abdd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51054.exe

Filesize
468KB

MD5
9502e9716c8f30ad57c2f02ed77048d9

SHA1
52ae4d226abca01c38fb6e08ec744cba473b9ec1

SHA256
26104104b0f4fe5b5ed287e7e3e2b3d5b3746028ac82a60dbd97a18a005b7c33

SHA512
f6424ec7840e821c841e6080aeff80cada5a73e0d537c910adca7dafb6e1773d9ec0b862cf6f27335aad5571713f96ead2f87d582f2352e6d142f1bb2dba5e22

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51874.exe

Filesize
468KB

MD5
d0fd293421e9078460583412a43b67f6

SHA1
fdd7960cce28cb7300ca686e657fa1eb39022daa

SHA256
b4ed3e929bdea888ca262ee672980b67f477be9d2ed85c41979b979b5b0d8b15

SHA512
c7a276ad239df90999109fd64b6071a0b18ffe987f3031e211e2d17d882801d2acf8dda7897e06e20791dc81b08a62191216ad838c49c139a2410c6b100dfbaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52220.exe

Filesize
468KB

MD5
df720075e255d96caa5e7d352e3bb1e6

SHA1
4690f6ca1a55a9cbe00be57807a87866dc095f9b

SHA256
f6acac86b820769b808af841a54d96285583c6ab1a4242232c1a39b33d5311b1

SHA512
6833fed1aa3466426c4f77d370e14dfe1ace5b1cb8f260c16207983418a9ceb6420677ff509f0609e78f05be9f05d4563758ac57c40c04249d963d955b1a1dd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55641.exe

Filesize
468KB

MD5
7af6df8e04c9df323ea0386475ed76ba

SHA1
5a56c48b2b283faf6c27ca3fcdc175916de90991

SHA256
eea2960ec455405811de7329a2e53610105dc3e836e38ec2339345478ba2b07a

SHA512
23d49394f7b08bdfcfd45b8be11b00e23f7ee2829e203d8877f49ed1f8f833f4028fc9c83d908b5cad6b15a177aab89b2bae4ccb18a227139073faa9e31e9f55

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58350.exe

Filesize
468KB

MD5
aac03e56e94a6a14c6ae9f6b157d5716

SHA1
dc54a6c4ed9f8c8dd6febd8444997dfc34c82e01

SHA256
9a652900cfd5df40e027c1d92ad388c0d2dc9888c1bfc567a568c8e75d2eb91a

SHA512
b54703914b8f6c54687817511de68a1e81b1bd29fc8b0e318eb8a80c2112842b994a2cd6bc4537830888674946e3bd466188bf5965e48aa1ded92f00d5183916

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58693.exe

Filesize
468KB

MD5
fc7c786d03bc25903a15d2b7af1fe811

SHA1
04605ec3dc5e3f375e21a9408503d7ff0e7a3a2b

SHA256
798b423f2961a9e388a01bc43df79eb4d6375b61b84e6ca4c0e05320d21c4809

SHA512
2e41fc992a9106a4611ce3a44ee3eab06542d0cc1b273faee34aacdd980be1545c7b4efdefeca8c25f6f37c3013be00886f4cb12c1d44bedd189451c0832f222

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61644.exe

Filesize
468KB

MD5
a319350269fdf7a7ac2112b5f524c9db

SHA1
5d1080992d0739fbd5f05537a7bdb49f3faf17a5

SHA256
51041c46de758d246ef2bc380b9b934805ea3f9aad12e0069a0e555d25b404b8

SHA512
19e20e1a1e73546b0c76b8e14cd2db852335f9ca936efca66981dde5ea668ada286a06564b11f4233bc24277e2310939f5aa62edbfc2f6483cf29106b5183d17

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63306.exe

Filesize
468KB

MD5
1295881883f0ddfb0b1a9ebdfe755ee6

SHA1
3d7901af6edaab6fec56059ef9fa7fe45a555b36

SHA256
63c2653439432ab7f812cc2908f433ee0d8b55a7bf977d592b87ad82f6f55e32

SHA512
fa608f6c68945740ea394cf19826bf43770994c8d2b667a452f8e8d2a57556c25b94e2f6fbe202625f33178ddc4c519b0f22c6a0548a670849868c5fe2886d97

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64998.exe

Filesize
468KB

MD5
290f255a68374c757e2cdb62b4121c0b

SHA1
cbeac30502a382dd477ca534268ca0390d87e9eb

SHA256
e08f46399f4a84f7d5e4b2d1aecd152fb1302674153a459cb847d9e332381108

SHA512
d8280213b4c8686e9748d20d580ea8727739a03da68db547a9ad171bd1109c138d5e5e6b1cff128e00f2294461b46b39945aaba22549f8bd5a33bee37c83a4ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-65366.exe

Filesize
468KB

MD5
6b96e244f0306c1357381ce0c7e95207

SHA1
d62de2e743e9ff11ff3dae5534fa81909981145e

SHA256
fa2ceedcc82d423a196bc89a7d3d68ed3984f9bd14bb554a1606e937169b5edd

SHA512
4a639534bebf67e8d55075967924e9481a93270a15eab8dce31940d72f0f52758bdb18f3e2b379f9045814d705dd10c5ece89b81121ef4da4b7b26dd545fa562

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-65413.exe

Filesize
468KB

MD5
9ac447bacc01d6a366d9a0c04f54654f

SHA1
f836f714d9f5ce7ceadee51cbc2f0b15e3f4bd14

SHA256
c4ec1089c076da10fed593d9726fc0c99e4a4a24bcf16ec9ea0c4346e4ac3fc0

SHA512
d000311d653465f77da729a7b379d2daa7d4d75d07f8a20877737494db41bd11c3be617b597c9f8eb1b28dc6d6a5001c42fee447941ca1494a4fbb72891c46e6

Download Submit
memory/184-316-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/208-287-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/232-315-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/372-63-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/384-509-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/408-113-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/620-503-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/732-246-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/768-402-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/860-255-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/876-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/888-417-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/912-386-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1092-88-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1376-326-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1428-457-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1432-288-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1436-90-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1500-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1508-92-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1508-2672-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1552-461-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1680-471-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1744-504-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1776-387-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1788-257-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1904-384-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2064-35-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2092-37-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2096-317-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2216-318-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2292-458-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2344-91-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2344-2670-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2396-220-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2424-193-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2428-508-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2448-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2468-328-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2472-82-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2496-231-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2520-241-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2536-58-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2564-323-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2572-512-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2608-431-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2676-192-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2688-212-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2752-130-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2848-146-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2912-185-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3016-324-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3160-269-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3232-385-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3308-388-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3320-236-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3324-155-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3344-445-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3560-404-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3600-43-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3616-194-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3712-364-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3724-264-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3784-207-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3800-443-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3884-325-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3908-425-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3956-276-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3972-164-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3996-226-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4004-121-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4076-392-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4108-414-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4184-505-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4284-271-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4320-150-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4380-347-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4388-181-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4428-337-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4536-444-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4564-19-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4580-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4600-106-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4832-175-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4872-391-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4880-357-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4920-413-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5040-430-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5048-403-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5132-520-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5148-523-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5172-510-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5180-533-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5196-532-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5208-511-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5264-530-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5480-576-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5500-577-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15720-2601-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads