b04423fad52a576e8328332e8ffc3f6b03ca51b607a8575313d7e954240861d6

Analysis

max time kernel
119s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/09/2024, 17:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1ab72d50146d4e69a109adafead39cb0N.exe
Size

468KB
MD5

1ab72d50146d4e69a109adafead39cb0
SHA1

0a14793ae0dd46908509ec2acb67bc4629e6dfe0
SHA256

b04423fad52a576e8328332e8ffc3f6b03ca51b607a8575313d7e954240861d6
SHA512

62bbf25543363e62cd47db11de734ce6836e61902521aa61debd4955d880318ae157c274f5ae502a7738242fe650e6d3097c655e2dd2589917aedbf65c2a6419
SSDEEP

3072:dRmaogBRjm8U2bY9Pz3yTf8/0lhWlIpZSpHGvTzkm7F+L5wlTwli:dRboinU2+PDyTfc0n0m7gdwlT

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3436	Unicorn-36580.exe
1068	Unicorn-55376.exe
344	Unicorn-23258.exe
2700	Unicorn-46388.exe
1848	Unicorn-18354.exe
3972	Unicorn-30052.exe
3228	Unicorn-11669.exe
3076	Unicorn-44224.exe
4196	Unicorn-8022.exe
3176	Unicorn-19720.exe
4280	Unicorn-62790.exe
2308	Unicorn-28080.exe
408	Unicorn-8214.exe
2788	Unicorn-27815.exe
2100	Unicorn-28080.exe
3500	Unicorn-4870.exe
4360	Unicorn-54839.exe
4044	Unicorn-48901.exe
404	Unicorn-31081.exe
2044	Unicorn-9530.exe
4696	Unicorn-45717.exe
4368	Unicorn-26059.exe
4348	Unicorn-26059.exe
1104	Unicorn-13806.exe
4316	Unicorn-26059.exe
3060	Unicorn-30143.exe
3104	Unicorn-65045.exe
3672	Unicorn-51310.exe
5064	Unicorn-5373.exe
1276	Unicorn-55394.exe
3112	Unicorn-12218.exe
2992	Unicorn-21133.exe
4772	Unicorn-40999.exe
3808	Unicorn-4797.exe
4448	Unicorn-15919.exe
1420	Unicorn-7750.exe
2940	Unicorn-3401.exe
1708	Unicorn-63073.exe
4764	Unicorn-1812.exe
212	Unicorn-17071.exe
2124	Unicorn-21155.exe
1452	Unicorn-8133.exe
2812	Unicorn-54190.exe
1372	Unicorn-61803.exe
1140	Unicorn-17433.exe
3240	Unicorn-1466.exe
5008	Unicorn-24116.exe
4396	Unicorn-50091.exe
1768	Unicorn-21503.exe
3652	Unicorn-13334.exe
1604	Unicorn-5166.exe
4584	Unicorn-46754.exe
1172	Unicorn-38585.exe
2844	Unicorn-50283.exe
1772	Unicorn-29100.exe
2292	Unicorn-18165.exe
992	Unicorn-29863.exe
1552	Unicorn-1829.exe
3576	Unicorn-13261.exe
1948	Unicorn-7396.exe
4556	Unicorn-34715.exe
3108	Unicorn-34715.exe
3700	Unicorn-63495.exe
4920	Unicorn-2042.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36163.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3122.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33225.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43365.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45862.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51747.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49891.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11898.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8304.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24435.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1269.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23558.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64169.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65045.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3084.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35426.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11850.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43407.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55955.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24725.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62937.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16192.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42493.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30624.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5265.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35672.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62790.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57994.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3195.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26059.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3682.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1010.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28307.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2598.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38166.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33313.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56333.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15248.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34975.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25301.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46984.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64456.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41171.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1269.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62198.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48742.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37824.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36563.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18233.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26039.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12218.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50283.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47905.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38659.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33157.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46849.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27123.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27815.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37595.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13682.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3652.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36807.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15478.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43637.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	2704	dwm.exe
Token: SeChangeNotifyPrivilege	2704	dwm.exe
Token: 33	2704	dwm.exe
Token: SeIncBasePriorityPrivilege	2704	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4436	1ab72d50146d4e69a109adafead39cb0N.exe
3436	Unicorn-36580.exe
1068	Unicorn-55376.exe
344	Unicorn-23258.exe
2700	Unicorn-46388.exe
1848	Unicorn-18354.exe
3972	Unicorn-30052.exe
3228	Unicorn-11669.exe
3076	Unicorn-44224.exe
4196	Unicorn-8022.exe
408	Unicorn-8214.exe
2100	Unicorn-28080.exe
2788	Unicorn-27815.exe
4280	Unicorn-62790.exe
2308	Unicorn-28080.exe
3176	Unicorn-19720.exe
3500	Unicorn-4870.exe
4360	Unicorn-54839.exe
4044	Unicorn-48901.exe
404	Unicorn-31081.exe
2044	Unicorn-9530.exe
4696	Unicorn-45717.exe
4348	Unicorn-26059.exe
4368	Unicorn-26059.exe
3060	Unicorn-30143.exe
3672	Unicorn-51310.exe
1104	Unicorn-13806.exe
5064	Unicorn-5373.exe
4316	Unicorn-26059.exe
3104	Unicorn-65045.exe
1276	Unicorn-55394.exe
3112	Unicorn-12218.exe
4772	Unicorn-40999.exe
2992	Unicorn-21133.exe
3808	Unicorn-4797.exe
1420	Unicorn-7750.exe
4448	Unicorn-15919.exe
1708	Unicorn-63073.exe
2940	Unicorn-3401.exe
4764	Unicorn-1812.exe
212	Unicorn-17071.exe
1452	Unicorn-8133.exe
2124	Unicorn-21155.exe
1372	Unicorn-61803.exe
2812	Unicorn-54190.exe
1140	Unicorn-17433.exe
3240	Unicorn-1466.exe
5008	Unicorn-24116.exe
4396	Unicorn-50091.exe
1768	Unicorn-21503.exe
4584	Unicorn-46754.exe
3652	Unicorn-13334.exe
1604	Unicorn-5166.exe
1172	Unicorn-38585.exe
2844	Unicorn-50283.exe
3576	Unicorn-13261.exe
1948	Unicorn-7396.exe
992	Unicorn-29863.exe
1552	Unicorn-1829.exe
1772	Unicorn-29100.exe
2292	Unicorn-18165.exe
4556	Unicorn-34715.exe
3108	Unicorn-34715.exe
4792	Unicorn-32145.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4436 wrote to memory of 3436	4436	1ab72d50146d4e69a109adafead39cb0N.exe	87
PID 4436 wrote to memory of 3436	4436	1ab72d50146d4e69a109adafead39cb0N.exe	87
PID 4436 wrote to memory of 3436	4436	1ab72d50146d4e69a109adafead39cb0N.exe	87
PID 3436 wrote to memory of 1068	3436	Unicorn-36580.exe	90
PID 3436 wrote to memory of 1068	3436	Unicorn-36580.exe	90
PID 3436 wrote to memory of 1068	3436	Unicorn-36580.exe	90
PID 4436 wrote to memory of 344	4436	1ab72d50146d4e69a109adafead39cb0N.exe	91
PID 4436 wrote to memory of 344	4436	1ab72d50146d4e69a109adafead39cb0N.exe	91
PID 4436 wrote to memory of 344	4436	1ab72d50146d4e69a109adafead39cb0N.exe	91
PID 1068 wrote to memory of 2700	1068	Unicorn-55376.exe	94
PID 1068 wrote to memory of 2700	1068	Unicorn-55376.exe	94
PID 1068 wrote to memory of 2700	1068	Unicorn-55376.exe	94
PID 3436 wrote to memory of 1848	3436	Unicorn-36580.exe	95
PID 3436 wrote to memory of 1848	3436	Unicorn-36580.exe	95
PID 3436 wrote to memory of 1848	3436	Unicorn-36580.exe	95
PID 344 wrote to memory of 3972	344	Unicorn-23258.exe	96
PID 344 wrote to memory of 3972	344	Unicorn-23258.exe	96
PID 344 wrote to memory of 3972	344	Unicorn-23258.exe	96
PID 4436 wrote to memory of 3228	4436	1ab72d50146d4e69a109adafead39cb0N.exe	97
PID 4436 wrote to memory of 3228	4436	1ab72d50146d4e69a109adafead39cb0N.exe	97
PID 4436 wrote to memory of 3228	4436	1ab72d50146d4e69a109adafead39cb0N.exe	97
PID 2700 wrote to memory of 3076	2700	Unicorn-46388.exe	101
PID 2700 wrote to memory of 3076	2700	Unicorn-46388.exe	101
PID 2700 wrote to memory of 3076	2700	Unicorn-46388.exe	101
PID 1068 wrote to memory of 4196	1068	Unicorn-55376.exe	102
PID 1068 wrote to memory of 4196	1068	Unicorn-55376.exe	102
PID 1068 wrote to memory of 4196	1068	Unicorn-55376.exe	102
PID 1848 wrote to memory of 3176	1848	Unicorn-18354.exe	103
PID 1848 wrote to memory of 3176	1848	Unicorn-18354.exe	103
PID 1848 wrote to memory of 3176	1848	Unicorn-18354.exe	103
PID 3436 wrote to memory of 4280	3436	Unicorn-36580.exe	104
PID 3436 wrote to memory of 4280	3436	Unicorn-36580.exe	104
PID 3436 wrote to memory of 4280	3436	Unicorn-36580.exe	104
PID 3228 wrote to memory of 2308	3228	Unicorn-11669.exe	105
PID 3228 wrote to memory of 2308	3228	Unicorn-11669.exe	105
PID 3228 wrote to memory of 2308	3228	Unicorn-11669.exe	105
PID 344 wrote to memory of 408	344	Unicorn-23258.exe	106
PID 344 wrote to memory of 408	344	Unicorn-23258.exe	106
PID 344 wrote to memory of 408	344	Unicorn-23258.exe	106
PID 3972 wrote to memory of 2100	3972	Unicorn-30052.exe	108
PID 3972 wrote to memory of 2100	3972	Unicorn-30052.exe	108
PID 3972 wrote to memory of 2100	3972	Unicorn-30052.exe	108
PID 4436 wrote to memory of 2788	4436	1ab72d50146d4e69a109adafead39cb0N.exe	107
PID 4436 wrote to memory of 2788	4436	1ab72d50146d4e69a109adafead39cb0N.exe	107
PID 4436 wrote to memory of 2788	4436	1ab72d50146d4e69a109adafead39cb0N.exe	107
PID 3076 wrote to memory of 3500	3076	Unicorn-44224.exe	109
PID 3076 wrote to memory of 3500	3076	Unicorn-44224.exe	109
PID 3076 wrote to memory of 3500	3076	Unicorn-44224.exe	109
PID 4196 wrote to memory of 4360	4196	Unicorn-8022.exe	110
PID 4196 wrote to memory of 4360	4196	Unicorn-8022.exe	110
PID 4196 wrote to memory of 4360	4196	Unicorn-8022.exe	110
PID 1068 wrote to memory of 4044	1068	Unicorn-55376.exe	111
PID 1068 wrote to memory of 4044	1068	Unicorn-55376.exe	111
PID 1068 wrote to memory of 4044	1068	Unicorn-55376.exe	111
PID 2700 wrote to memory of 404	2700	Unicorn-46388.exe	112
PID 2700 wrote to memory of 404	2700	Unicorn-46388.exe	112
PID 2700 wrote to memory of 404	2700	Unicorn-46388.exe	112
PID 2788 wrote to memory of 2044	2788	Unicorn-27815.exe	113
PID 2788 wrote to memory of 2044	2788	Unicorn-27815.exe	113
PID 2788 wrote to memory of 2044	2788	Unicorn-27815.exe	113
PID 4436 wrote to memory of 4696	4436	1ab72d50146d4e69a109adafead39cb0N.exe	114
PID 4436 wrote to memory of 4696	4436	1ab72d50146d4e69a109adafead39cb0N.exe	114
PID 4436 wrote to memory of 4696	4436	1ab72d50146d4e69a109adafead39cb0N.exe	114
PID 4280 wrote to memory of 4368	4280	Unicorn-62790.exe	116

C:\Users\Admin\AppData\Local\Temp\1ab72d50146d4e69a109adafead39cb0N.exe
"C:\Users\Admin\AppData\Local\Temp\1ab72d50146d4e69a109adafead39cb0N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36580.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36580.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55376.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55376.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46388.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46388.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44224.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4870.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12218.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63495.exe
        8⤵
        Executes dropped EXE
        
        PID:3700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30195.exe
        9⤵
        
        PID:5552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24435.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:6372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1010.exe
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:11180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25301.exe
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:15080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30817.exe
        10⤵
        
        PID:9344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15160.exe
        10⤵
        
        PID:14084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60122.exe
        9⤵
        
        PID:6148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7118.exe
        10⤵
        
        PID:12316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28080.exe
        10⤵
        
        PID:4496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52249.exe
        9⤵
        
        PID:11212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3293.exe
        9⤵
        
        PID:13728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35793.exe
        8⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40771.exe
        9⤵
        
        PID:6236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59406.exe
        9⤵
        
        PID:7160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52110.exe
        9⤵
        
        PID:14032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63397.exe
        9⤵
        
        PID:7452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3084.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3905.exe
        8⤵
        
        PID:10660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14088.exe
        8⤵
        
        PID:14936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46676.exe
        8⤵
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11917.exe
        7⤵
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3682.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62883.exe
        9⤵
        
        PID:8148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24031.exe
        10⤵
        
        PID:12936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3000.exe
        10⤵
        
        PID:8508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45758.exe
        9⤵
        
        PID:10612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16888.exe
        9⤵
        
        PID:14792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45782.exe
        9⤵
        
        PID:624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11744.exe
        9⤵
        
        PID:1748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49406.exe
        8⤵
        
        PID:7992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28307.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15828.exe
        9⤵
        
        PID:3012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5928.exe
        8⤵
        
        PID:11312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8024.exe
        7⤵
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34819.exe
        8⤵
        
        PID:8848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41969.exe
        8⤵
        
        PID:11868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36822.exe
        7⤵
        
        PID:8900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4953.exe
        7⤵
        
        PID:14008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14312.exe
        7⤵
        
        PID:2380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21133.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34715.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54699.exe
        8⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31259.exe
        9⤵
        
        PID:7140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3122.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:10516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59090.exe
        10⤵
        
        PID:15344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9437.exe
        9⤵
        
        PID:9788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22944.exe
        9⤵
        
        PID:13640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31783.exe
        9⤵
        
        PID:6900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33157.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9370.exe
        9⤵
        
        PID:10280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42405.exe
        9⤵
        
        PID:13404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2829.exe
        9⤵
        
        PID:5060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62198.exe
        8⤵
        
        PID:8560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44021.exe
        8⤵
        
        PID:14024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64365.exe
        8⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56946.exe
        7⤵
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43807.exe
        8⤵
        
        PID:8112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56386.exe
        8⤵
        
        PID:11260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20885.exe
        8⤵
        
        PID:5088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63149.exe
        8⤵
        
        PID:14788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3195.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28078.exe
        7⤵
        
        PID:9248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36091.exe
        8⤵
        
        PID:12988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30833.exe
        8⤵
        
        PID:5080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10659.exe
        8⤵
        
        PID:6672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40565.exe
        7⤵
        
        PID:13476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5965.exe
        7⤵
        
        PID:14780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38700.exe
        7⤵
        
        PID:6936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50349.exe
        6⤵
        
        PID:3940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39213.exe
        7⤵
        
        PID:6632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32043.exe
        8⤵
        
        PID:8456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6557.exe
        8⤵
        
        PID:12296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53547.exe
        8⤵
        
        PID:4220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30956.exe
        7⤵
        
        PID:8764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55514.exe
        7⤵
        
        PID:12396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13620.exe
        7⤵
        
        PID:1816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38202.exe
        6⤵
        
        PID:6840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33387.exe
        7⤵
        
        PID:9920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9209.exe
        7⤵
        
        PID:13664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3652.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30313.exe
        6⤵
        
        PID:11456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35346.exe
        6⤵
        
        PID:5648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31081.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7750.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56479.exe
        7⤵
        
        PID:1528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10350.exe
        8⤵
        
        PID:4040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47019.exe
        9⤵
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50491.exe
        10⤵
        
        PID:9688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46245.exe
        10⤵
        
        PID:15208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1269.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:9852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43365.exe
        9⤵
        
        PID:13544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34309.exe
        8⤵
        
        PID:7388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62198.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44021.exe
        8⤵
        
        PID:13852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3661.exe
        7⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43807.exe
        8⤵
        
        PID:6356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3610.exe
        9⤵
        
        PID:12952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56386.exe
        8⤵
        
        PID:8928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42537.exe
        8⤵
        
        PID:15136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41133.exe
        7⤵
        
        PID:8904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53594.exe
        7⤵
        
        PID:11956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59429.exe
        7⤵
        
        PID:2008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44398.exe
        6⤵
        
        PID:3796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16127.exe
        7⤵
        
        PID:6212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3454.exe
        8⤵
        
        PID:6700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23595.exe
        9⤵
        
        PID:14000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10892.exe
        9⤵
        
        PID:3128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1513.exe
        8⤵
        
        PID:11376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18721.exe
        8⤵
        
        PID:3816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32789.exe
        7⤵
        
        PID:8540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15248.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37030.exe
        7⤵
        
        PID:14004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12300.exe
        6⤵
        
        PID:6228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24031.exe
        7⤵
        
        PID:12916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35301.exe
        7⤵
        
        PID:2492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44416.exe
        7⤵
        
        PID:7600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33122.exe
        6⤵
        
        PID:9812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26039.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-412.exe
        7⤵
        
        PID:3896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40565.exe
        6⤵
        
        PID:13552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50829.exe
        6⤵
        
        PID:14524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63073.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46753.exe
        6⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62639.exe
        7⤵
        
        PID:8396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16889.exe
        7⤵
        
        PID:11508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26578.exe
        6⤵
        
        PID:6444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25084.exe
        6⤵
        
        PID:12272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63998.exe
        5⤵
        
        PID:4704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36163.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64035.exe
        7⤵
        
        PID:6640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56386.exe
        7⤵
        
        PID:10468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39567.exe
        7⤵
        
        PID:2312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42057.exe
        6⤵
        
        PID:9188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17797.exe
        6⤵
        
        PID:13000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15728.exe
        6⤵
        
        PID:540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29536.exe
        5⤵
        
        PID:6556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20367.exe
        6⤵
        
        PID:9396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29629.exe
        6⤵
        
        PID:13436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15828.exe
        6⤵
        
        PID:6292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51502.exe
        5⤵
        
        PID:8292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46611.exe
        5⤵
        
        PID:13060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20477.exe
        5⤵
        
        PID:14620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8022.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8022.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54839.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40999.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34715.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59359.exe
        8⤵
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6946.exe
        9⤵
        
        PID:7104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55047.exe
        10⤵
        
        PID:9148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21165.exe
        10⤵
        
        PID:12108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17989.exe
        9⤵
        
        PID:9528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43365.exe
        9⤵
        
        PID:13456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27123.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:7296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21148.exe
        8⤵
        
        PID:8068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10449.exe
        8⤵
        
        PID:11192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13808.exe
        8⤵
        
        PID:15256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52738.exe
        8⤵
        
        PID:7476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-729.exe
        7⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1186.exe
        8⤵
        
        PID:8408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36563.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:11188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18528.exe
        9⤵
        
        PID:15296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16889.exe
        8⤵
        
        PID:11500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8460.exe
        7⤵
        
        PID:8168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37834.exe
        7⤵
        
        PID:11320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32145.exe
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54699.exe
        7⤵
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1430.exe
        8⤵
        
        PID:8176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51031.exe
        9⤵
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45425.exe
        8⤵
        
        PID:11060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41010.exe
        8⤵
        
        PID:13856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30648.exe
        8⤵
        
        PID:12344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49406.exe
        7⤵
        
        PID:6184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5928.exe
        7⤵
        
        PID:11340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6488.exe
        6⤵
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5270.exe
        7⤵
        
        PID:8340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5092.exe
        8⤵
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16889.exe
        7⤵
        
        PID:11756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9017.exe
        7⤵
        
        PID:14544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7279.exe
        7⤵
        
        PID:6928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31778.exe
        6⤵
        
        PID:4892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12448.exe
        6⤵
        
        PID:11400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4797.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2042.exe
        6⤵
        Executes dropped EXE
        
        PID:4920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14434.exe
        7⤵
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6666.exe
        8⤵
        
        PID:7724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56386.exe
        8⤵
        
        PID:9892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51134.exe
        7⤵
        
        PID:8444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30624.exe
        7⤵
        
        PID:11548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46038.exe
        6⤵
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58918.exe
        7⤵
        
        PID:8672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23019.exe
        8⤵
        
        PID:14824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32363.exe
        8⤵
        
        PID:3320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5352.exe
        7⤵
        
        PID:11672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30277.exe
        7⤵
        
        PID:14220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47957.exe
        6⤵
        
        PID:8580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36490.exe
        6⤵
        
        PID:11484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62602.exe
        5⤵
        
        PID:5884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64123.exe
        6⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14850.exe
        7⤵
        
        PID:14808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9140.exe
        6⤵
        
        PID:10484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5265.exe
        6⤵
        
        PID:14512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46984.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57497.exe
        5⤵
        
        PID:7364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35301.exe
        6⤵
        
        PID:988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10560.exe
        6⤵
        
        PID:14788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31972.exe
        6⤵
        
        PID:15064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47557.exe
        5⤵
        
        PID:10248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9766.exe
        5⤵
        
        PID:14268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20294.exe
        5⤵
        
        PID:5228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48901.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48901.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15919.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51627.exe
        6⤵
        
        PID:4024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59935.exe
        7⤵
        
        PID:5312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58918.exe
        8⤵
        
        PID:8664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5352.exe
        8⤵
        
        PID:11664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34221.exe
        7⤵
        
        PID:8572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30624.exe
        7⤵
        
        PID:11616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34169.exe
        6⤵
        
        PID:6504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64175.exe
        7⤵
        
        PID:9192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33787.exe
        8⤵
        
        PID:14764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21357.exe
        7⤵
        
        PID:12232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7279.exe
        7⤵
        
        PID:6304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62477.exe
        6⤵
        
        PID:8988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8164.exe
        7⤵
        
        PID:6980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17797.exe
        6⤵
        
        PID:13008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30277.exe
        6⤵
        
        PID:15092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64626.exe
        5⤵
        
        PID:2092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28379.exe
        6⤵
        
        PID:6192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16179.exe
        7⤵
        
        PID:6456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27679.exe
        8⤵
        
        PID:14760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24195.exe
        8⤵
        
        PID:7320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33225.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64154.exe
        6⤵
        
        PID:8864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55705.exe
        6⤵
        
        PID:11860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64169.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20469.exe
        5⤵
        
        PID:7492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31420.exe
        5⤵
        
        PID:10332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9229.exe
        5⤵
        
        PID:14240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23094.exe
        5⤵
        
        PID:14444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3401.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3401.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38917.exe
        5⤵
        
        PID:5928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6178.exe
        6⤵
        
        PID:4140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14590.exe
        7⤵
        
        PID:7100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18233.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23615.exe
        7⤵
        
        PID:5336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5737.exe
        6⤵
        
        PID:9580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31079.exe
        7⤵
        
        PID:5960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43365.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52395.exe
        6⤵
        
        PID:7052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26664.exe
        5⤵
        
        PID:1404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46651.exe
        6⤵
        
        PID:12876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38166.exe
        5⤵
        
        PID:9588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26909.exe
        5⤵
        
        PID:15168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59417.exe
      4⤵
      PID:3616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51082.exe
        5⤵
        
        PID:6820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3454.exe
        6⤵
        
        PID:8604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60873.exe
        7⤵
        
        PID:8784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38461.exe
        6⤵
        
        PID:11800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31207.exe
        6⤵
        
        PID:6100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6452.exe
        5⤵
        
        PID:4424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55514.exe
        5⤵
        
        PID:12388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38700.exe
        5⤵
        
        PID:6972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13001.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13001.exe
      4⤵
      PID:6592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51747.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55285.exe
        5⤵
        
        PID:15092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45146.exe
        5⤵
        
        PID:15180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28687.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28687.exe
      4⤵
      PID:8660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64487.exe
        5⤵
        
        PID:12884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43840.exe
        5⤵
        
        PID:7484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25848.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25848.exe
      4⤵
      PID:12404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55697.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55697.exe
      4⤵
      PID:14540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32546.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32546.exe
      4⤵
      PID:1808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18354.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18354.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19720.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19720.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26059.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61803.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65415.exe
        7⤵
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51871.exe
        8⤵
        
        PID:4088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51731.exe
        9⤵
        
        PID:8404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50522.exe
        9⤵
        
        PID:11444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52011.exe
        9⤵
        
        PID:1392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16540.exe
        8⤵
        
        PID:9960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4497.exe
        8⤵
        
        PID:13492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24289.exe
        8⤵
        
        PID:2416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34309.exe
        7⤵
        
        PID:7396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2598.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62198.exe
        7⤵
        
        PID:9904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33681.exe
        6⤵
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47019.exe
        7⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63599.exe
        8⤵
        
        PID:8884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58185.exe
        9⤵
        
        PID:14660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33993.exe
        8⤵
        
        PID:11948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21066.exe
        8⤵
        
        PID:1544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37833.exe
        7⤵
        
        PID:8564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51533.exe
        7⤵
        
        PID:13516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31098.exe
        6⤵
        
        PID:7980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1784.exe
        6⤵
        
        PID:10228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20918.exe
        6⤵
        
        PID:15232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17433.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65415.exe
        6⤵
        
        PID:5344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46635.exe
        7⤵
        
        PID:6620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1186.exe
        8⤵
        
        PID:8360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3869.exe
        8⤵
        
        PID:11592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13620.exe
        8⤵
        
        PID:2496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24621.exe
        7⤵
        
        PID:8568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48310.exe
        8⤵
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15248.exe
        7⤵
        
        PID:11360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8137.exe
        7⤵
        
        PID:2492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18955.exe
        7⤵
        
        PID:6836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12404.exe
        6⤵
        
        PID:7180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45862.exe
        6⤵
        
        PID:8384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44021.exe
        6⤵
        
        PID:14208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18865.exe
        6⤵
        
        PID:7744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10660.exe
        5⤵
        
        PID:5624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38851.exe
        6⤵
        
        PID:6324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46755.exe
        7⤵
        
        PID:13984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1269.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43365.exe
        6⤵
        
        PID:13484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41082.exe
        5⤵
        
        PID:7552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52811.exe
        6⤵
        
        PID:13244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7660.exe
        6⤵
        
        PID:7284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47181.exe
        5⤵
        
        PID:10408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5145.exe
        5⤵
        
        PID:13408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4893.exe
        5⤵
        
        PID:2904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1812.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1812.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39567.exe
        5⤵
        
        PID:2952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46635.exe
        6⤵
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37943.exe
        7⤵
        
        PID:8316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16889.exe
        7⤵
        
        PID:11764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4933.exe
        7⤵
        
        PID:14780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2332.exe
        7⤵
        
        PID:14404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35867.exe
        7⤵
        
        PID:7048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65462.exe
        6⤵
        
        PID:8484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15248.exe
        6⤵
        
        PID:11652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10056.exe
        6⤵
        
        PID:13824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16821.exe
        5⤵
        
        PID:5420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12966.exe
        6⤵
        
        PID:9896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9209.exe
        6⤵
        
        PID:13656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7604.exe
        5⤵
        
        PID:9308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21025.exe
        5⤵
        
        PID:14016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32094.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32094.exe
      4⤵
      PID:5128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55659.exe
        5⤵
        
        PID:6004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29177.exe
        6⤵
        
        PID:4852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48045.exe
        7⤵
        
        PID:2012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46961.exe
        6⤵
        
        PID:11432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22480.exe
        6⤵
        
        PID:12000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49406.exe
        5⤵
        
        PID:8004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30624.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3688.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3688.exe
      4⤵
      PID:5584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33859.exe
        5⤵
        
        PID:8284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16889.exe
        5⤵
        
        PID:11580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6577.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6577.exe
      4⤵
      PID:4912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25231.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25231.exe
      4⤵
      PID:12508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28462.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28462.exe
      4⤵
      PID:1272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62790.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62790.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26059.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26059.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50091.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57823.exe
        6⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63355.exe
        7⤵
        
        PID:6848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17627.exe
        8⤵
        
        PID:9648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46245.exe
        8⤵
        
        PID:15152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58254.exe
        7⤵
        
        PID:8312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49649.exe
        7⤵
        
        PID:12284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58046.exe
        6⤵
        
        PID:6280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28307.exe
        7⤵
        
        PID:6300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36248.exe
        7⤵
        
        PID:5908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32300.exe
        6⤵
        
        PID:9432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55697.exe
        6⤵
        
        PID:15268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58186.exe
        5⤵
        
        PID:5792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34383.exe
        6⤵
        
        PID:6572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46303.exe
        7⤵
        
        PID:8372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16889.exe
        7⤵
        
        PID:11492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64169.exe
        7⤵
        
        PID:14004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16453.exe
        6⤵
        
        PID:8724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52197.exe
        6⤵
        
        PID:11480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30556.exe
        5⤵
        
        PID:6160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42323.exe
        6⤵
        
        PID:9732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1425.exe
        6⤵
        
        PID:14080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13469.exe
        5⤵
        
        PID:8652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12360.exe
        5⤵
        
        PID:14064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6744.exe
        5⤵
        
        PID:3028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13620.exe
        5⤵
        
        PID:8752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46754.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46754.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43407.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5514.exe
        6⤵
        
        PID:8184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44067.exe
        7⤵
        
        PID:12104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19912.exe
        7⤵
        
        PID:14188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49842.exe
        6⤵
        
        PID:10652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16888.exe
        6⤵
        
        PID:14688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20065.exe
        6⤵
        
        PID:8496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49406.exe
        5⤵
        
        PID:8024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30624.exe
        5⤵
        
        PID:11624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47905.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47905.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59515.exe
        5⤵
        
        PID:8948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20676.exe
        5⤵
        
        PID:13200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17564.exe
        5⤵
        
        PID:15200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19333.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19333.exe
      4⤵
      PID:8036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13216.exe
      4⤵
      PID:12980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64730.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64730.exe
      4⤵
      PID:14540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64126.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64126.exe
      4⤵
      PID:876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5373.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5373.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21503.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36827.exe
        5⤵
        
        PID:5720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51871.exe
        6⤵
        
        PID:6436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63599.exe
        7⤵
        
        PID:8956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25825.exe
        7⤵
        
        PID:11992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37833.exe
        6⤵
        
        PID:8532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51533.exe
        6⤵
        
        PID:13412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38393.exe
        5⤵
        
        PID:7432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50735.exe
        6⤵
        
        PID:12956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1356.exe
        5⤵
        
        PID:10288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17901.exe
        5⤵
        
        PID:14220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60106.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60106.exe
      4⤵
      PID:5276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47595.exe
        5⤵
        
        PID:7108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26563.exe
        6⤵
        
        PID:10000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42649.exe
        6⤵
        
        PID:14276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12042.exe
        6⤵
        
        PID:5172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42493.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43365.exe
        5⤵
        
        PID:13560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46893.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46893.exe
      4⤵
      PID:7216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15811.exe
        5⤵
        
        PID:15348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48062.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48062.exe
      4⤵
      PID:10128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37824.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37824.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49891.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49891.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29100.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29100.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14434.exe
      4⤵
      PID:5252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27367.exe
        5⤵
        
        PID:7008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11534.exe
        6⤵
        
        PID:15336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31201.exe
        5⤵
        
        PID:10100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52110.exe
        5⤵
        
        PID:15144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17397.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17397.exe
      4⤵
      PID:7528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53579.exe
        5⤵
        
        PID:13616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23580.exe
        5⤵
        
        PID:3040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7859.exe
        5⤵
        
        PID:8020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21200.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21200.exe
      4⤵
      PID:10360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34430.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34430.exe
      4⤵
      PID:12896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32825.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32825.exe
      4⤵
      PID:9884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30193.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30193.exe
    3⤵
    PID:5988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29177.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29177.exe
      4⤵
      PID:7124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
      4⤵
      PID:11460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60871.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60871.exe
    3⤵
    PID:7960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47664.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47664.exe
    3⤵
    PID:11300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50481.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50481.exe
    3⤵
    PID:15236
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23258.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23258.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30052.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30052.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28080.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28080.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30143.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50283.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21451.exe
        7⤵
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20351.exe
        8⤵
        
        PID:6404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24835.exe
        9⤵
        
        PID:8300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35913.exe
        9⤵
        
        PID:12432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57974.exe
        9⤵
        
        PID:8820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60417.exe
        8⤵
        
        PID:10296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36350.exe
        8⤵
        
        PID:15292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56038.exe
        7⤵
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39997.exe
        7⤵
        
        PID:8936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52686.exe
        7⤵
        
        PID:1460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40801.exe
        7⤵
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1944.exe
        7⤵
        
        PID:1456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7397.exe
        6⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1430.exe
        7⤵
        
        PID:8104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34947.exe
        8⤵
        
        PID:3580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21061.exe
        7⤵
        
        PID:10576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16696.exe
        7⤵
        
        PID:14660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61482.exe
        7⤵
        
        PID:5384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63141.exe
        6⤵
        
        PID:6396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65078.exe
        6⤵
        
        PID:11352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1829.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37595.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13682.exe
        7⤵
        
        PID:7944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-546.exe
        8⤵
        
        PID:1956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22719.exe
        8⤵
        
        PID:14936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33313.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16696.exe
        7⤵
        
        PID:14644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49406.exe
        6⤵
        
        PID:6764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5928.exe
        6⤵
        
        PID:11332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51260.exe
        6⤵
        
        PID:7248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21324.exe
        5⤵
        
        PID:5732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64035.exe
        6⤵
        
        PID:8156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35079.exe
        7⤵
        
        PID:15072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25466.exe
        7⤵
        
        PID:5040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56386.exe
        6⤵
        
        PID:11236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62957.exe
        6⤵
        
        PID:15220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47060.exe
        6⤵
        
        PID:7480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9281.exe
        5⤵
        
        PID:8460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27824.exe
        5⤵
        
        PID:11520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51310.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51310.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1466.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64839.exe
        6⤵
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43127.exe
        7⤵
        
        PID:6460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34975.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-220.exe
        8⤵
        
        PID:540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11897.exe
        8⤵
        
        PID:8392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13224.exe
        7⤵
        
        PID:10492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5265.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19531.exe
        7⤵
        
        PID:7152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21481.exe
        6⤵
        
        PID:7560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26039.exe
        7⤵
        
        PID:12860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57589.exe
        7⤵
        
        PID:3684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49981.exe
        6⤵
        
        PID:10396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30346.exe
        6⤵
        
        PID:13692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50402.exe
        5⤵
        
        PID:5676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30875.exe
        6⤵
        
        PID:6496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56895.exe
        7⤵
        
        PID:13072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58638.exe
        6⤵
        
        PID:9876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43365.exe
        6⤵
        
        PID:13424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18955.exe
        6⤵
        
        PID:8512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27048.exe
        5⤵
        
        PID:7692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58903.exe
        6⤵
        
        PID:12904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45337.exe
        6⤵
        
        PID:3040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35426.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62137.exe
        5⤵
        
        PID:14552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49891.exe
        5⤵
        
        PID:15204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24116.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24116.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4730.exe
        5⤵
        
        PID:5688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27367.exe
        6⤵
        
        PID:6712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32043.exe
        7⤵
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1513.exe
        7⤵
        
        PID:11696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60179.exe
        7⤵
        
        PID:2216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-501.exe
        6⤵
        
        PID:9404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43365.exe
        6⤵
        
        PID:13604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54886.exe
        5⤵
        
        PID:7080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63577.exe
        5⤵
        
        PID:10644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22754.exe
        5⤵
        
        PID:14772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21185.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21185.exe
      4⤵
      PID:6116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47019.exe
        5⤵
        
        PID:6476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42515.exe
        6⤵
        
        PID:9324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46245.exe
        6⤵
        
        PID:15192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62390.exe
        5⤵
        
        PID:10540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49329.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49329.exe
      4⤵
      PID:7620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18393.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18393.exe
      4⤵
      PID:10436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29803.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29803.exe
      4⤵
      PID:14344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8214.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8214.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26059.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26059.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5166.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35047.exe
        6⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13682.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8462.exe
        8⤵
        
        PID:13576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11565.exe
        8⤵
        
        PID:1924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57485.exe
        7⤵
        
        PID:10452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49406.exe
        6⤵
        
        PID:8012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5928.exe
        6⤵
        
        PID:11324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59045.exe
        6⤵
        
        PID:8204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59058.exe
        5⤵
        
        PID:6384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33719.exe
        6⤵
        
        PID:8124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36807.exe
        7⤵
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52022.exe
        7⤵
        
        PID:15264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52208.exe
        7⤵
        
        PID:7064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25145.exe
        6⤵
        
        PID:10592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16696.exe
        6⤵
        
        PID:14652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16557.exe
        6⤵
        
        PID:6252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63333.exe
        5⤵
        
        PID:8100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27599.exe
        6⤵
        
        PID:2312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13161.exe
        6⤵
        
        PID:5024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48742.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38585.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38585.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58783.exe
        5⤵
        
        PID:5912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54995.exe
        6⤵
        
        PID:6660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40403.exe
        7⤵
        
        PID:8628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38461.exe
        7⤵
        
        PID:11544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21008.exe
        6⤵
        
        PID:9912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13049.exe
        6⤵
        
        PID:14248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33349.exe
        5⤵
        
        PID:7076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28535.exe
        6⤵
        
        PID:9372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29629.exe
        6⤵
        
        PID:13448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32300.exe
        5⤵
        
        PID:9576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55697.exe
        5⤵
        
        PID:15352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23713.exe
        5⤵
        
        PID:5380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8304.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8304.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20351.exe
        5⤵
        
        PID:6816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19563.exe
        6⤵
        
        PID:12924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52201.exe
        6⤵
        
        PID:8328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55322.exe
        5⤵
        
        PID:6288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52110.exe
        5⤵
        
        PID:15200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10101.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10101.exe
      4⤵
      PID:6412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44067.exe
        5⤵
        
        PID:12384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52201.exe
        5⤵
        
        PID:7348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37196.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37196.exe
      4⤵
      PID:11248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27293.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27293.exe
      4⤵
      PID:14324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65045.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65045.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29863.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29863.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23371.exe
        5⤵
        
        PID:5812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20351.exe
        6⤵
        
        PID:7116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15478.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38689.exe
        6⤵
        
        PID:10776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34814.exe
        6⤵
        
        PID:15028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6540.exe
        5⤵
        
        PID:7616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19912.exe
        6⤵
        
        PID:6296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36490.exe
        5⤵
        
        PID:11564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25676.exe
        5⤵
        
        PID:236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49353.exe
        5⤵
        
        PID:15024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11030.exe
        5⤵
        
        PID:2536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62937.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9560.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9560.exe
      4⤵
      PID:6580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42603.exe
        5⤵
        
        PID:9096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41585.exe
        5⤵
        
        PID:12252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9785.exe
        5⤵
        
        PID:15308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32840.exe
        5⤵
        
        PID:15356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56822.exe
        5⤵
        
        PID:7792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20101.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20101.exe
      4⤵
      PID:9412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40565.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40565.exe
      4⤵
      PID:13524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13261.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13261.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58783.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58783.exe
      4⤵
      PID:5900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51871.exe
        5⤵
        
        PID:4816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28203.exe
        6⤵
        
        PID:10772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7279.exe
        6⤵
        
        PID:6284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13521.exe
        5⤵
        
        PID:9832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22944.exe
        5⤵
        
        PID:13628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11363.exe
        5⤵
        
        PID:2752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46562.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46562.exe
      4⤵
      PID:7356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45831.exe
        5⤵
        
        PID:10004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15811.exe
        6⤵
        
        PID:15256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49474.exe
        5⤵
        
        PID:13680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62198.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62198.exe
      4⤵
      PID:11228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19324.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19324.exe
      4⤵
      PID:15244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8436.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8436.exe
    3⤵
    PID:6084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20351.exe
      4⤵
      PID:6364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29791.exe
        5⤵
        
        PID:10476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42784.exe
        5⤵
        
        PID:6984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56333.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56333.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48986.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48986.exe
      4⤵
      PID:15012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49230.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49230.exe
      4⤵
      PID:2312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50438.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50438.exe
    3⤵
    PID:6472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51415.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51415.exe
      4⤵
      PID:15104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39956.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39956.exe
      4⤵
      PID:8720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37727.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37727.exe
    3⤵
    PID:8452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31385.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31385.exe
    3⤵
    PID:4652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32546.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32546.exe
    3⤵
    PID:540
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11669.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11669.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28080.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28080.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13806.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13806.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13334.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4730.exe
        6⤵
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55187.exe
        7⤵
        
        PID:6804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42603.exe
        8⤵
        
        PID:9068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41585.exe
        8⤵
        
        PID:12052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58254.exe
        7⤵
        
        PID:8528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46490.exe
        7⤵
        
        PID:13860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29265.exe
        6⤵
        
        PID:4968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23019.exe
        7⤵
        
        PID:14740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32300.exe
        6⤵
        
        PID:10180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4497.exe
        6⤵
        
        PID:13676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6608.exe
        6⤵
        
        PID:2012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44035.exe
        6⤵
        
        PID:5896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50594.exe
        5⤵
        
        PID:6016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46827.exe
        6⤵
        
        PID:6676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41171.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53354.exe
        8⤵
        
        PID:14896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35913.exe
        7⤵
        
        PID:12412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21008.exe
        6⤵
        
        PID:9928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43637.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25872.exe
        6⤵
        
        PID:6748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43001.exe
        5⤵
        
        PID:5332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50683.exe
        6⤵
        
        PID:9224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46245.exe
        6⤵
        
        PID:15176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61482.exe
        6⤵
        
        PID:7032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38166.exe
        5⤵
        
        PID:9316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54027.exe
        5⤵
        
        PID:15092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65073.exe
        5⤵
        
        PID:6688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18165.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18165.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11850.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65467.exe
        6⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5094.exe
        7⤵
        
        PID:9464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33085.exe
        7⤵
        
        PID:368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47735.exe
        7⤵
        
        PID:1208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15249.exe
        6⤵
        
        PID:9388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52110.exe
        6⤵
        
        PID:15184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10624.exe
        5⤵
        
        PID:7632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36490.exe
        5⤵
        
        PID:11556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16192.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63283.exe
        5⤵
        
        PID:14284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44457.exe
        5⤵
        
        PID:3992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24725.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36822.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36822.exe
      4⤵
      PID:8872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46849.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63082.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63082.exe
      4⤵
      PID:1116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55394.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55394.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32721.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32721.exe
      4⤵
      PID:5464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10070.exe
        5⤵
        
        PID:6768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3454.exe
        6⤵
        
        PID:8704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1513.exe
        6⤵
        
        PID:11368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-885.exe
        5⤵
        
        PID:8964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46490.exe
        5⤵
        
        PID:14192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43001.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43001.exe
      4⤵
      PID:3656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49111.exe
        5⤵
        
        PID:13964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64645.exe
        5⤵
        
        PID:384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38166.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38166.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27101.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27101.exe
      4⤵
      PID:14188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63938.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63938.exe
      4⤵
      PID:15132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7396.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7396.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33511.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33511.exe
      4⤵
      PID:5952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13962.exe
        5⤵
        
        PID:6604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29391.exe
        6⤵
        
        PID:8544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28757.exe
        6⤵
        
        PID:11792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45234.exe
        5⤵
        
        PID:8844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8040.exe
        5⤵
        
        PID:12320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29708.exe
        5⤵
        
        PID:2484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34040.exe
        5⤵
        
        PID:7788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12404.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12404.exe
      4⤵
      PID:6208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45862.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45862.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44021.exe
      4⤵
      PID:14780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7572.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7572.exe
      4⤵
      PID:8804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6925.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6925.exe
    3⤵
    PID:5124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58799.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58799.exe
      4⤵
      PID:7912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16785.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16785.exe
      4⤵
      PID:10544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64937.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64937.exe
      4⤵
      PID:14500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29956.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29956.exe
      4⤵
      PID:7796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60341.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60341.exe
    3⤵
    PID:7924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11289.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11289.exe
    3⤵
    PID:11572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45566.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45566.exe
    3⤵
    PID:2200
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27815.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27815.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9530.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9530.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17071.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17071.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64263.exe
        5⤵
        
        PID:2404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24295.exe
        6⤵
        
        PID:6196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14014.exe
        7⤵
        
        PID:9108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41585.exe
        7⤵
        
        PID:12060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35949.exe
        6⤵
        
        PID:3364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15056.exe
        6⤵
        
        PID:11704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31108.exe
        6⤵
        
        PID:8696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6733.exe
        5⤵
        
        PID:6220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27256.exe
        5⤵
        
        PID:9804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49230.exe
        5⤵
        
        PID:13536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41273.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41273.exe
      4⤵
      PID:5204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38659.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59323.exe
        6⤵
        
        PID:8812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41969.exe
        6⤵
        
        PID:11880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17221.exe
        5⤵
        
        PID:9024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46490.exe
        5⤵
        
        PID:14096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43001.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43001.exe
      4⤵
      PID:5856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3838.exe
        5⤵
        
        PID:9300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29629.exe
        5⤵
        
        PID:13508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40486.exe
        5⤵
        
        PID:7020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38166.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38166.exe
      4⤵
      PID:9772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4384.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4384.exe
      4⤵
      PID:14256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54190.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54190.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20299.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20299.exe
      4⤵
      PID:5304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50911.exe
        5⤵
        
        PID:6784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55011.exe
        6⤵
        
        PID:13132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-885.exe
        5⤵
        
        PID:7192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46490.exe
        5⤵
        
        PID:14052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37433.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37433.exe
      4⤵
      PID:7092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19563.exe
        5⤵
        
        PID:908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28080.exe
        5⤵
        
        PID:6308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32300.exe
      4⤵
      PID:9356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55697.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55697.exe
      4⤵
      PID:15276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25988.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25988.exe
      4⤵
      PID:6920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1532.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1532.exe
    3⤵
    PID:5560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55955.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55955.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8882.exe
        5⤵
        
        PID:9964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49474.exe
        5⤵
        
        PID:13696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13521.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13521.exe
      4⤵
      PID:9936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63402.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63402.exe
      4⤵
      PID:14980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57994.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57994.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64627.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64627.exe
      4⤵
      PID:15308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56106.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56106.exe
      4⤵
      PID:4900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64837.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64837.exe
      4⤵
      PID:3752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
    3⤵
    PID:10272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58238.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58238.exe
    3⤵
    PID:13960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50829.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50829.exe
    3⤵
    PID:4276
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45717.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45717.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21155.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21155.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10978.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10978.exe
      4⤵
      PID:4640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20019.exe
        5⤵
        
        PID:5944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40491.exe
        6⤵
        
        PID:8040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57730.exe
        6⤵
        
        PID:11292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10978.exe
        6⤵
        
        PID:216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27397.exe
        5⤵
        
        PID:8912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47729.exe
        5⤵
        
        PID:11964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18280.exe
        5⤵
        
        PID:7820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63910.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63910.exe
      4⤵
      PID:6700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10904.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10904.exe
      4⤵
      PID:7260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22723.exe
        5⤵
        
        PID:13284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35672.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23558.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23558.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9236.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9236.exe
      4⤵
      PID:14168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-433.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-433.exe
    3⤵
    PID:5316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55955.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55955.exe
      4⤵
      PID:6036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7538.exe
        5⤵
        
        PID:8648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22125.exe
        5⤵
        
        PID:11852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64456.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9140.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9140.exe
      4⤵
      PID:10500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5265.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5265.exe
      4⤵
      PID:14532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2060.exe
      4⤵
      PID:7324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35217.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35217.exe
    3⤵
    PID:7572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43594.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43594.exe
    3⤵
    PID:10428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29272.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29272.exe
    3⤵
    PID:14004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17820.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17820.exe
    3⤵
    PID:7604
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8133.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8133.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10978.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10978.exe
    3⤵
    PID:4272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34383.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34383.exe
      4⤵
      PID:6644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42603.exe
        5⤵
        
        PID:9060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41585.exe
        5⤵
        
        PID:12068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47735.exe
        5⤵
        
        PID:7952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17221.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17221.exe
      4⤵
      PID:9052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46490.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46490.exe
      4⤵
      PID:14156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26448.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26448.exe
      4⤵
      PID:6068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12404.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12404.exe
    3⤵
    PID:6332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36807.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36807.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45862.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45862.exe
    3⤵
    PID:10200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44021.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44021.exe
    3⤵
    PID:15100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10228.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10228.exe
    3⤵
    PID:3404
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11898.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11898.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39863.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39863.exe
    3⤵
    PID:5324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51783.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51783.exe
      4⤵
      PID:8084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57907.exe
        5⤵
        
        PID:9884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56106.exe
        5⤵
        
        PID:13852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48308.exe
        5⤵
        
        PID:5700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35965.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35965.exe
      4⤵
      PID:11176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38305.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38305.exe
    3⤵
    PID:8588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30624.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30624.exe
    3⤵
    PID:11608
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53076.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53076.exe
  2⤵
  PID:6336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49427.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49427.exe
    3⤵
    PID:8216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16889.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16889.exe
    3⤵
    PID:11536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4933.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4933.exe
    3⤵
    PID:13824
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62314.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62314.exe
  2⤵
  PID:8436
- C:\Users\Admin\AppData\Local\Temp\Unicorn-2565.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-2565.exe
  2⤵
  PID:11856
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10837.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10837.exe
  2⤵
  PID:14352
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4865.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4865.exe
  2⤵
  PID:14340

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11565.exe

Filesize
468KB

MD5
93867e628706f4bafdb0fd826b918b8d

SHA1
593d9518aa3b72d40af05ac0a70af09857cbc91c

SHA256
3996d903b7b7d73e844f5e625dcf07a3f37e280209242cc7529f66e2ece9334d

SHA512
778ece97730bbf165b2a2f754dddc291777c7ff26183f6d50e4917ded3b37087037551670f206b2c98ef327491287a50939e8fc6f3200849262992a1d3f8fee6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11669.exe

Filesize
468KB

MD5
fc81193e81b743e95253792ea654d685

SHA1
973ee7a2eb6499be7a089f010533f937d2db6751

SHA256
96030bceafe020ffd6b22d585fd07c61e5b7a614f73d90c5c749faf40afd2ede

SHA512
0be5edfdb04fbdb8d632d04c1b358ac5b818c43cae139406c1d8b937e1ae5b2d3c89989f3d16ce9f7ddca96a370f7970380a81bf66b74e63f43acbf52d9e1d33

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12218.exe

Filesize
468KB

MD5
c4601f59e5022b375c76dfd6167d3bbe

SHA1
da8e28f2ed7ecbae48dd94d74b105ac2715dd73d

SHA256
738908b4bb917e4305c25148f25c49bb4072e343405912f696ced8b697574e00

SHA512
52c9af8730ed8950b1321f3573b7b4e934e1605c81ad2dabf286230de8171ce7d61b4b5010483e01962b957f9e20e1cfd72a3d951ad6bb2f16f2b49f8bbc6e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13806.exe

Filesize
468KB

MD5
73b4fa233f01435d43e7bf0e37fd48f2

SHA1
27448c7d3a3a085e6701ab56fd56d15cc8d2ce13

SHA256
effe8b095b6d7feedb44f7d45c8ec190722275f2aa7eb0eeae47ec82ea5979c1

SHA512
3d4c10350b99b006aa14ee8270a2f02fdc165fe26931a968097c91fadc384794b7a9c5056948bb958de860495aa2f847be41baf0abd8736e1ff3755d9deb9232

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18354.exe

Filesize
468KB

MD5
f8d97c6c694e5d5e5eee124883b4cb71

SHA1
406bfb4ce6af048825af6bf617697e51e00701eb

SHA256
d5cb8c341f3fc24b81d0051e95e5fcee0a10b97acf25a3dce2f05ab43698426e

SHA512
b0374e6f138f25c6df64ac2fd5ccfa8293850301bdb96971c68ae3cc91ea611b8e3fca79c7b86cbe04310a62657143cfd675dc7d7ea8f3de7a0983a294a5a74d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19720.exe

Filesize
468KB

MD5
b625a45aa52ff6453c32c20729f84028

SHA1
bdc9fbcb9dc5cb4ec6f0ac34b8f9d79091d6b7e7

SHA256
5b2ec4f75a0fa3fedbd96409788bcd4430715747664ecdb5f98921985bba0e62

SHA512
0d61b7521b8352847724f60902110342dd1a28b43f2f358ba7b90e6d88dfab4d92bc97c245f7a4fcd1ce69217768dd2153cb73faea6d979d0e2b05cf7bfdc42f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21133.exe

Filesize
468KB

MD5
39028f90759f42e0ade3aac16e9ddaa7

SHA1
559d6e1d0f7dd02d34ed77d2423c35c6b9181561

SHA256
7c6e190b69c6d5ff791c795e138846f98504867162e18a1c6dac6bcdd48fdcd0

SHA512
78169bd7bc83cb22c6c658498a99b8a1b6f6ebc1c6eccd7a0fcb6bd4ff9771c761b7bf6e681aee6bf60da2446f4603a597615e6dc4c8e73f9b8393340e07eb54

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23258.exe

Filesize
468KB

MD5
efa913608f751fffa2660fb7a59bd279

SHA1
188124f821140c5491b07d4de6b7026a54227297

SHA256
7047dde1d30c79a42d5646882a7a462820356a80195d4d482edc4867f10e6407

SHA512
9371cb6b50e43c763e029a95f9eea0089c7eaaf29a867ca83f87e0061c4484cd68f47e07f10f39373d4dd479d6cbb0beee08c4383dbd33d0b97cb9f232ef21f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26059.exe

Filesize
468KB

MD5
2d6a537e201624b5694290d6677921de

SHA1
8a75909b40a575a29bd579403e3054b154e5328b

SHA256
22711cf859cc2cceeffa2f66992ec1963758ec2353dac7611f84970fe84c9b69

SHA512
09323c8c762ff34735cd94d4653471714d27925ffc99b463864b53de455e81b64dfeb9c2bde3c5142baf6f8d4b6dca0cf91ae851182395400cf2add91412b837

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27815.exe

Filesize
468KB

MD5
e9b7b988e58a7ddbb83290ac11349d86

SHA1
f21763b335a402cd79f1f9114106bfe35cf727cb

SHA256
5960a87398351aee1a496c70d9565f06b66f833823716abb5c9c906336a8dbd9

SHA512
0e687186e84750c1a6181671c960a1a9c3db8e76f72ba422a4c90435b395d8a4740f6fbf6416e71e8175e765e7ff444e6423d9814f4d1e69a4687e958cb019be

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28080.exe

Filesize
468KB

MD5
523ca2bb0ce58512e4bc4a3a801c08be

SHA1
95c8ee3320a98addac17e8b428bff616591b139d

SHA256
8988be97c309322f77368815b39ee61cb3ddfd8d44ef47bb3c9d0a4140b6bc15

SHA512
9668dc721a643c7b207d6d63bde982325c852ff4a3cc2f916ee076ed6a5f1dbcf5218081bd37a1193b78fa202ddfc7299170db2f9bfed0b4f08ffa7ab5d9336f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30052.exe

Filesize
468KB

MD5
b3e7f0fac06bd49528ad37a83f24ce3c

SHA1
fa2cb15dd7513dc5f9c64da46da0bc920357f5d5

SHA256
b35b7d284d23a0576955c175c80a820b148da8ae4a5988fcbc1b8e85cb6cf33d

SHA512
ff66ca85b6e36828adb2cf39e78b6354ef52c1b1b932c03158b11e72ff6cd3fef57d86d930230e7c42b11dcbce3be92aab4c59d1aa227d958e59ffcf51eb91f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31081.exe

Filesize
468KB

MD5
ed2a4123485c992c9fec03fec77c7680

SHA1
10a9572874893b4fbd45480c3d52b04db189ae2c

SHA256
597fafad45434feea34bf978f52ce31acc185bd7019bc4f6c07cd2051ec1376c

SHA512
5b3faeea40697bb7fc1de21171854df142263a458cc40772c50d2708149ada32fd9099d8ddf76087404a54a3080cd8a48802bbd43d72402d9be7ae22394578fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36580.exe

Filesize
468KB

MD5
e23a2975adb693bba50f31ab679fa8f8

SHA1
71c421af244ac841ef44e6382b43ad3db516c377

SHA256
390a49c21bc5555d9020938ecfc94413aeee4754b954cab38e8afa2372549c51

SHA512
c3a27a01180830d2bac281a8752adf571279722aaa3de4ba7f323629dc37d1598c9b26e79d3e75a414ed696c3d699c6c23d7b643e12adf51dc9be71b63d65fd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40999.exe

Filesize
468KB

MD5
f1abfe602322a6be5ed0ba9588a24573

SHA1
48582da71af78567336a103d1cd143057bce3cee

SHA256
8ca63b6a3ceea31bd1f036221c33faba2cf5f096d383c2a38bf04484fbf32a88

SHA512
cdaa8f39a610fa246e126facd946896b56cc55c08b6a755bb770dd925b26fb78243a1696d2791699de4fec4abd4f3caa3b150508fbd0347755d2c65d7eda3632

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44224.exe

Filesize
468KB

MD5
3c9288a631197162ff4b450c93c1eadc

SHA1
286f8241cb20f26f37fa2810c9cd12837cef0dd4

SHA256
70e573cb950dcc618384a24a896d247456879fde4a5fea368f665865790da64e

SHA512
6937f9e59a3919885fbae950330515eb3505945a2ca33ca5c8e525f0f6c8bebe174b05356b55f4d26b36d59bf89cc9e4aa00c2c254390b659b3fd5dbe81aea30

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45717.exe

Filesize
468KB

MD5
8201d05f7bdebf82eac790ff89a6150c

SHA1
15b267db48a0517110cbfcb386242ad6b5dbc90f

SHA256
3063e4c153ab8ae328375e7b9eab1f684d3bcc5b041205a3dee2c997f3aa1728

SHA512
bc173c9064352740ef018bca4d85525a98089d19315c05efbde8ad126867501516d4534df607da726102330f9924148747b67f25238e31079ed6e5eb7b9a8429

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46388.exe

Filesize
468KB

MD5
10fd5b0ba81344b98037bab9277b2405

SHA1
9cd53487b35001de567d47616585cd3c5ee1b41d

SHA256
cbacb2880f0b7d06128ec77178508b6c1995b5cda175285cad818bd7b9d2a4a1

SHA512
19dc90f1dd5c7f6e0dfbf037d84d3e9121f0b828c56cc73c9644902847748270d7e1306892dc89dbcfeb1c95c96261a8c7f7aee91a067b10f14637d007b58bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4870.exe

Filesize
468KB

MD5
cc3f3d25e30ebace776098f57549f0e1

SHA1
8ee538664c45f4425c271122fa9db7e58fc26426

SHA256
991d4352d1efe8e0b8e527e79f621691e471e9cfe8a226220bd38c43d61d0a6c

SHA512
fe1be60c72214dd2d2302ec2df6a1525a3bf2de263e29b24d2d6cc89021ea9a628c073d9b9c0fcc9942f430b390532146e81f355a6cf60abd794e0a8b22ab0a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48901.exe

Filesize
468KB

MD5
53e11616fc6a0a3eb5c776671f4339e8

SHA1
fc56cc16b474901fc85fac7298ec7c33b659168f

SHA256
e02c969f13a6e82aacdbd0f53f9e7b3e346e4ea4e6b4f31e3357c954aa47f137

SHA512
de1e1b4f2a96fe5a605fe79728eaa5b9ad5917eb515ddd50133e62e8a22cb8be57c8ce1917810840f0bcd669f442d1f5a3a6c3b418b005233193eddda27b81a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51310.exe

Filesize
468KB

MD5
fff3fcd1fe67c5b573a9a0813eca4607

SHA1
caeb6c005aeb98cc78b11efdb5bd878992338d78

SHA256
25a6bcfbce07c6242fbaded713364a4fda5115fce9bb04273e2dc684a7da7b2c

SHA512
6a3041450ddf47528f4a50695b2ae757db7f835366b6280e2a7ffe13099a26a369ccfcdd2c01263557ff907795d67cbedc40a7a05dbb8261c73e458c92690203

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5373.exe

Filesize
468KB

MD5
053a473fa361b6f6465411244d7bd732

SHA1
dd1272c88674a58ee14f77934d713ed89c527bd3

SHA256
0de88fccc5261395381086f281df9e23e67319326a6c1632b429b3a1c497fb87

SHA512
99f18d51a82de56818d35913116e95a17faf221e7a22aad14f7f777daa77e46e3860bee1275ac7f6b8664045f778820ad17635866ae93c2fe2dcbda70680bb78

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54839.exe

Filesize
468KB

MD5
b81f1e1b22dcf2aafd5522b19d81ec29

SHA1
e3dc4369b2873c63ab9a702f3f226ffcb62112d3

SHA256
3ceb98f2cf4fc21e1136e7c1237fb23c6aac692f3aac14daf310da9de9596136

SHA512
7be1539887efefd9a96053c65e452d07b648191b3caea542d5e312b6d7f1a3a48fa9b44cb43f65a1f2ba8ebe261196a0da1654ee2bd9f7ad48f4a2f3219ef578

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55376.exe

Filesize
468KB

MD5
99857296de3dbd1b6faf0a893a8524d2

SHA1
9c4f082b226f6434058284c6a69ee89481ca10f7

SHA256
6561b0e727b6fea3d31a6f30dfdfd030cca7c846db844caaf9d29bc698f63ba8

SHA512
140a26ed08a00f728d12cd4855bbbc1db67da212e666a3c1c6b23b46b6af4036b99f9e2fc68e084864f185caf38e9a122e74d8c467c3745afe7b528e34e639f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55394.exe

Filesize
468KB

MD5
34342fc187b1bc8bc8c84985b0429131

SHA1
7c95a8a90a08d03b486b37b40b0a25052afeb0ca

SHA256
058e424e6e4f718582bd0bd3148e15a48dac378e81546d932816b7b7a4a97838

SHA512
b6a5a41e1e2126999afc12a99f81e8263a2b7f33ffc8966c880c2c039a93abd854124845214090ec88e183c240c4fd00734a1da88c2fb69522f41cafae49aedc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62790.exe

Filesize
468KB

MD5
5c08ebb7e2d8bae2a1a5f7012ea4b7a2

SHA1
0b9dc6fe8275bb7224c636ae7d03fe60f1d2842b

SHA256
151a977db97052f1c1faa8d7f190a18646897ef8c113c8c942a7b67aeb5546b2

SHA512
28fc7f3b9f16ddfb0679a8005701bab883b2758c68e755fbc964028a8034572dd9c450924b95a552413591cf0e0b6fb223010627d1e8cf90c50da3a630ec3f96

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-65045.exe

Filesize
468KB

MD5
b1208d2d5e4e221f537d7843f9b56c96

SHA1
0b90c9c2e78bf7025d059158373fd7a584a85ebd

SHA256
42557d6924ca71d5ec76947a909e4ece3481fa260195226664aa85cd885d7f18

SHA512
343686f1f53826a94be3a6839fd716879fc742faff087d48ef6f122a73658428afd1a3f93c34de9fcacefb79a908c31d5902eabe513de94b2de2031703ae0bcb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8022.exe

Filesize
468KB

MD5
0c6816ffd190d2f51984a92046c92104

SHA1
f439ca133837e6a4433b6c61263ec1bae5184d8c

SHA256
f28b72af00ee781999f753835a1289b8fbda9d488318ed62f1447b08c72967d2

SHA512
0b6131bdf33b298a31fab62a8568d2e35aaa643ef50aa5e4b05e375b214a4ffb53134c55a67129f2f558a227347e67b5d8f5844e469e602fa2d3c3712672314f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8214.exe

Filesize
468KB

MD5
e4ad202966db0ba576288f1827e377c5

SHA1
8a67256743be8637b4a79c67c6927d787a27af66

SHA256
81c55274f42e2d9c8996b483c0c65a39bef9a79a75b55f73cf21760710c23010

SHA512
c36ca2b73c1b0db2fd871e99c5b609106403c26ac655583fa8e537b928d6861cd55acb4117d1e3f2ccd6139cd5fb39fab420362ac248f3c1c6feaa9dda185db1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9530.exe

Filesize
468KB

MD5
05689243b595bb6895f7a66f3cc85feb

SHA1
8144770560d617153936f80ec573c86e09b46db9

SHA256
e9cea62009bbb5145ca8e3ac78096250a21266f3a2a7f1c2495c041775498a02

SHA512
8dff9294e9bb71c944a4d77d645a25e531980f83817c723fb3d314303ed264d5109921943b316aea531204f0b56ff0af7e78abc6c0739bdf90a0f63cc9a03244

Download Submit
memory/212-261-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/344-19-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/404-125-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/408-89-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/540-3018-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/992-339-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1068-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1104-179-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1140-277-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1172-341-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1276-183-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1372-276-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1420-239-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1452-264-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1528-412-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1552-350-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1604-331-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1708-244-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1768-305-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1772-337-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1848-33-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1948-354-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2044-140-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2124-263-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2292-338-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2308-88-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2404-438-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2484-2909-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2700-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2728-397-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2788-90-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2812-273-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2844-335-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2940-243-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2952-415-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2992-214-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3076-55-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3104-180-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3108-376-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3112-207-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3176-67-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3228-47-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3240-288-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3436-7-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3500-106-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3576-353-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3580-3552-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3616-439-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3652-329-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3672-181-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3700-377-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3796-422-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3808-226-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3940-414-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3972-46-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4024-419-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4044-122-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4196-63-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4220-3728-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4272-416-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4280-74-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4360-114-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4368-178-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4396-302-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4436-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4448-233-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4556-375-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4584-334-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4696-151-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4704-425-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4764-252-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4772-216-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4792-392-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4920-378-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5008-291-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5064-182-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5088-2727-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5128-434-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5204-450-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5296-443-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5304-446-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5316-447-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5344-469-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5436-470-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5464-471-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5560-487-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5576-482-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5624-488-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5636-496-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5668-497-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5676-489-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5688-494-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5720-495-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5792-498-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5884-552-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5900-553-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5912-554-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5928-555-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5952-556-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5972-565-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6016-557-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/13824-2799-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads