e2056a129696495a9a8abb2921e61821e1c65de8f06accf3dd57f45b61d6e53d

Analysis

max time kernel
119s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 06:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e2056a129696495a9a8abb2921e61821e1c65de8f06accf3dd57f45b61d6e53dN.exe
Size

468KB
MD5

59e2d1687ad44b8043f199eece564340
SHA1

dba1c98af64ee73b692f33d8306305f8f343a263
SHA256

e2056a129696495a9a8abb2921e61821e1c65de8f06accf3dd57f45b61d6e53d
SHA512

d22de6dfaa0bbaa902b8ee14d9f64a1930c03071b9a18630aeb4deafc152ca7b6bfc4eff210a0309b100efc87793c41166f9a58025dbb1c217e8745e2527142c
SSDEEP

3072:sF+eogWdjf802bYk8zh7fNr/XmuMvIpjmDHQvVBT7hnN0pK+gAlb:sF/opk0238d7fN40Vv7hNIK+g

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3804	Unicorn-20123.exe
4396	Unicorn-12250.exe
1500	Unicorn-49754.exe
2200	Unicorn-62323.exe
2436	Unicorn-17953.exe
432	Unicorn-29651.exe
5108	Unicorn-936.exe
2300	Unicorn-45058.exe
1504	Unicorn-48779.exe
876	Unicorn-18144.exe
1924	Unicorn-52458.exe
1044	Unicorn-6786.exe
620	Unicorn-24275.exe
3124	Unicorn-55722.exe
2784	Unicorn-16115.exe
1324	Unicorn-35064.exe
3132	Unicorn-33987.exe
1424	Unicorn-22865.exe
4564	Unicorn-59259.exe
3040	Unicorn-42539.exe
4352	Unicorn-17769.exe
1084	Unicorn-18035.exe
1572	Unicorn-47370.exe
3308	Unicorn-1698.exe
3668	Unicorn-59067.exe
3676	Unicorn-13545.exe
3236	Unicorn-10944.exe
3560	Unicorn-8144.exe
4368	Unicorn-12938.exe
5036	Unicorn-36483.exe
4348	Unicorn-24785.exe
4716	Unicorn-19881.exe
2404	Unicorn-59555.exe
3700	Unicorn-33899.exe
388	Unicorn-3648.exe
212	Unicorn-8553.exe
740	Unicorn-28419.exe
4848	Unicorn-61283.exe
1068	Unicorn-57562.exe
4552	Unicorn-27457.exe
1016	Unicorn-43987.exe
2900	Unicorn-42569.exe
796	Unicorn-29379.exe
4664	Unicorn-34209.exe
4560	Unicorn-29955.exe
644	Unicorn-62554.exe
3152	Unicorn-54651.exe
3620	Unicorn-54651.exe
1332	Unicorn-37931.exe
1964	Unicorn-37931.exe
3724	Unicorn-29763.exe
1336	Unicorn-48329.exe
2284	Unicorn-48329.exe
3092	Unicorn-34593.exe
4380	Unicorn-45529.exe
848	Unicorn-26425.exe
4844	Unicorn-39275.exe
968	Unicorn-44106.exe
1768	Unicorn-63971.exe
4864	Unicorn-30915.exe
4988	Unicorn-47443.exe
3016	Unicorn-9024.exe
400	Unicorn-52082.exe
1200	Unicorn-38513.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27800.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64202.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22424.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53610.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24448.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43089.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28913.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38657.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60201.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62713.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7578.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51050.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29955.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33531.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16584.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38289.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24275.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27034.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45449.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39641.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46627.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2585.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11920.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52083.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38170.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32625.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39841.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1832.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56706.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55298.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-529.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33602.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55627.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27800.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3041.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6265.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54121.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50961.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12577.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15225.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4992.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29304.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49307.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35641.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32571.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51403.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30600.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14537.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33467.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46466.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1050.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28960.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54795.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60201.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45979.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28721.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50208.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28731.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35786.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46361.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33602.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13306.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40147.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24035.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	6092	dwm.exe
Token: SeChangeNotifyPrivilege	6092	dwm.exe
Token: 33	6092	dwm.exe
Token: SeIncBasePriorityPrivilege	6092	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3580	e2056a129696495a9a8abb2921e61821e1c65de8f06accf3dd57f45b61d6e53dN.exe
3804	Unicorn-20123.exe
4396	Unicorn-12250.exe
1500	Unicorn-49754.exe
2200	Unicorn-62323.exe
2436	Unicorn-17953.exe
5108	Unicorn-936.exe
2300	Unicorn-45058.exe
1504	Unicorn-48779.exe
620	Unicorn-24275.exe
876	Unicorn-18144.exe
1924	Unicorn-52458.exe
1044	Unicorn-6786.exe
3124	Unicorn-55722.exe
2784	Unicorn-16115.exe
1324	Unicorn-35064.exe
3132	Unicorn-33987.exe
1424	Unicorn-22865.exe
4564	Unicorn-59259.exe
3560	Unicorn-8144.exe
4352	Unicorn-17769.exe
3040	Unicorn-42539.exe
1572	Unicorn-47370.exe
3668	Unicorn-59067.exe
3308	Unicorn-1698.exe
3676	Unicorn-13545.exe
3236	Unicorn-10944.exe
1084	Unicorn-18035.exe
4368	Unicorn-12938.exe
4348	Unicorn-24785.exe
5036	Unicorn-36483.exe
4716	Unicorn-19881.exe
2404	Unicorn-59555.exe
3700	Unicorn-33899.exe
388	Unicorn-3648.exe
212	Unicorn-8553.exe
740	Unicorn-28419.exe
4848	Unicorn-61283.exe
1068	Unicorn-57562.exe
4552	Unicorn-27457.exe
1016	Unicorn-43987.exe
2900	Unicorn-42569.exe
796	Unicorn-29379.exe
4664	Unicorn-34209.exe
4560	Unicorn-29955.exe
644	Unicorn-62554.exe
1336	Unicorn-48329.exe
3724	Unicorn-29763.exe
3152	Unicorn-54651.exe
4380	Unicorn-45529.exe
1332	Unicorn-37931.exe
2284	Unicorn-48329.exe
848	Unicorn-26425.exe
3092	Unicorn-34593.exe
3620	Unicorn-54651.exe
1964	Unicorn-37931.exe
4844	Unicorn-39275.exe
968	Unicorn-44106.exe
1768	Unicorn-63971.exe
4864	Unicorn-30915.exe
3016	Unicorn-9024.exe
1200	Unicorn-38513.exe
4988	Unicorn-47443.exe
2000	Unicorn-5642.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3580 wrote to memory of 3804	3580	e2056a129696495a9a8abb2921e61821e1c65de8f06accf3dd57f45b61d6e53dN.exe	83
PID 3580 wrote to memory of 3804	3580	e2056a129696495a9a8abb2921e61821e1c65de8f06accf3dd57f45b61d6e53dN.exe	83
PID 3580 wrote to memory of 3804	3580	e2056a129696495a9a8abb2921e61821e1c65de8f06accf3dd57f45b61d6e53dN.exe	83
PID 3804 wrote to memory of 4396	3804	Unicorn-20123.exe	88
PID 3804 wrote to memory of 4396	3804	Unicorn-20123.exe	88
PID 3804 wrote to memory of 4396	3804	Unicorn-20123.exe	88
PID 3580 wrote to memory of 1500	3580	e2056a129696495a9a8abb2921e61821e1c65de8f06accf3dd57f45b61d6e53dN.exe	89
PID 3580 wrote to memory of 1500	3580	e2056a129696495a9a8abb2921e61821e1c65de8f06accf3dd57f45b61d6e53dN.exe	89
PID 3580 wrote to memory of 1500	3580	e2056a129696495a9a8abb2921e61821e1c65de8f06accf3dd57f45b61d6e53dN.exe	89
PID 4396 wrote to memory of 2200	4396	Unicorn-12250.exe	91
PID 4396 wrote to memory of 2200	4396	Unicorn-12250.exe	91
PID 4396 wrote to memory of 2200	4396	Unicorn-12250.exe	91
PID 3804 wrote to memory of 2436	3804	Unicorn-20123.exe	92
PID 3804 wrote to memory of 2436	3804	Unicorn-20123.exe	92
PID 3804 wrote to memory of 2436	3804	Unicorn-20123.exe	92
PID 1500 wrote to memory of 432	1500	Unicorn-49754.exe	93
PID 1500 wrote to memory of 432	1500	Unicorn-49754.exe	93
PID 1500 wrote to memory of 432	1500	Unicorn-49754.exe	93
PID 3580 wrote to memory of 5108	3580	e2056a129696495a9a8abb2921e61821e1c65de8f06accf3dd57f45b61d6e53dN.exe	94
PID 3580 wrote to memory of 5108	3580	e2056a129696495a9a8abb2921e61821e1c65de8f06accf3dd57f45b61d6e53dN.exe	94
PID 3580 wrote to memory of 5108	3580	e2056a129696495a9a8abb2921e61821e1c65de8f06accf3dd57f45b61d6e53dN.exe	94
PID 1500 wrote to memory of 2300	1500	Unicorn-49754.exe	97
PID 1500 wrote to memory of 2300	1500	Unicorn-49754.exe	97
PID 1500 wrote to memory of 2300	1500	Unicorn-49754.exe	97
PID 2436 wrote to memory of 1504	2436	Unicorn-17953.exe	98
PID 2436 wrote to memory of 1504	2436	Unicorn-17953.exe	98
PID 2436 wrote to memory of 1504	2436	Unicorn-17953.exe	98
PID 3804 wrote to memory of 876	3804	Unicorn-20123.exe	99
PID 3804 wrote to memory of 876	3804	Unicorn-20123.exe	99
PID 3804 wrote to memory of 876	3804	Unicorn-20123.exe	99
PID 4396 wrote to memory of 1924	4396	Unicorn-12250.exe	101
PID 4396 wrote to memory of 1924	4396	Unicorn-12250.exe	101
PID 4396 wrote to memory of 1924	4396	Unicorn-12250.exe	101
PID 5108 wrote to memory of 1044	5108	Unicorn-936.exe	102
PID 5108 wrote to memory of 1044	5108	Unicorn-936.exe	102
PID 5108 wrote to memory of 1044	5108	Unicorn-936.exe	102
PID 2200 wrote to memory of 620	2200	Unicorn-62323.exe	100
PID 2200 wrote to memory of 620	2200	Unicorn-62323.exe	100
PID 2200 wrote to memory of 620	2200	Unicorn-62323.exe	100
PID 3580 wrote to memory of 3124	3580	e2056a129696495a9a8abb2921e61821e1c65de8f06accf3dd57f45b61d6e53dN.exe	103
PID 3580 wrote to memory of 3124	3580	e2056a129696495a9a8abb2921e61821e1c65de8f06accf3dd57f45b61d6e53dN.exe	103
PID 3580 wrote to memory of 3124	3580	e2056a129696495a9a8abb2921e61821e1c65de8f06accf3dd57f45b61d6e53dN.exe	103
PID 2300 wrote to memory of 2784	2300	Unicorn-45058.exe	104
PID 2300 wrote to memory of 2784	2300	Unicorn-45058.exe	104
PID 2300 wrote to memory of 2784	2300	Unicorn-45058.exe	104
PID 1500 wrote to memory of 1324	1500	Unicorn-49754.exe	105
PID 1500 wrote to memory of 1324	1500	Unicorn-49754.exe	105
PID 1500 wrote to memory of 1324	1500	Unicorn-49754.exe	105
PID 1504 wrote to memory of 3132	1504	Unicorn-48779.exe	106
PID 1504 wrote to memory of 3132	1504	Unicorn-48779.exe	106
PID 1504 wrote to memory of 3132	1504	Unicorn-48779.exe	106
PID 2436 wrote to memory of 1424	2436	Unicorn-17953.exe	107
PID 2436 wrote to memory of 1424	2436	Unicorn-17953.exe	107
PID 2436 wrote to memory of 1424	2436	Unicorn-17953.exe	107
PID 620 wrote to memory of 4564	620	Unicorn-24275.exe	108
PID 620 wrote to memory of 4564	620	Unicorn-24275.exe	108
PID 620 wrote to memory of 4564	620	Unicorn-24275.exe	108
PID 876 wrote to memory of 3040	876	Unicorn-18144.exe	109
PID 876 wrote to memory of 3040	876	Unicorn-18144.exe	109
PID 876 wrote to memory of 3040	876	Unicorn-18144.exe	109
PID 3804 wrote to memory of 4352	3804	Unicorn-20123.exe	110
PID 3804 wrote to memory of 4352	3804	Unicorn-20123.exe	110
PID 3804 wrote to memory of 4352	3804	Unicorn-20123.exe	110
PID 1044 wrote to memory of 1084	1044	Unicorn-6786.exe	111

C:\Users\Admin\AppData\Local\Temp\e2056a129696495a9a8abb2921e61821e1c65de8f06accf3dd57f45b61d6e53dN.exe
"C:\Users\Admin\AppData\Local\Temp\e2056a129696495a9a8abb2921e61821e1c65de8f06accf3dd57f45b61d6e53dN.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3580
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20123.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20123.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12250.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12250.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62323.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62323.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24275.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59259.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28419.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19971.exe
        8⤵
        
        PID:1144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5658.exe
        9⤵
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20459.exe
        10⤵
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5329.exe
        10⤵
        
        PID:10088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59449.exe
        10⤵
        
        PID:13660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32466.exe
        10⤵
        
        PID:15352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61778.exe
        10⤵
        
        PID:2124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19529.exe
        9⤵
        
        PID:6344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30600.exe
        9⤵
        
        PID:10992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35641.exe
        9⤵
        
        PID:1312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53250.exe
        8⤵
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18923.exe
        9⤵
        
        PID:4204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7866.exe
        10⤵
        
        PID:6808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12153.exe
        9⤵
        
        PID:9736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3320.exe
        9⤵
        
        PID:13836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54121.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31435.exe
        9⤵
        
        PID:8608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28785.exe
        9⤵
        
        PID:12584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45249.exe
        9⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64426.exe
        8⤵
        
        PID:9708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57313.exe
        8⤵
        
        PID:13772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21681.exe
        8⤵
        
        PID:1892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33825.exe
        8⤵
        
        PID:5220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16633.exe
        7⤵
        
        PID:4720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-946.exe
        8⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41803.exe
        9⤵
        
        PID:8684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10337.exe
        9⤵
        
        PID:11140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29643.exe
        9⤵
        
        PID:2448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35786.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40889.exe
        8⤵
        
        PID:12548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24448.exe
        8⤵
        
        PID:14980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11920.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13482.exe
        8⤵
        
        PID:11472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28913.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40490.exe
        7⤵
        
        PID:8336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16275.exe
        8⤵
        
        PID:12956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6720.exe
        8⤵
        
        PID:5216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7432.exe
        7⤵
        
        PID:12692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43809.exe
        7⤵
        
        PID:15832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57562.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52643.exe
        7⤵
        
        PID:4372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49187.exe
        8⤵
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40179.exe
        9⤵
        
        PID:8076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46466.exe
        9⤵
        
        PID:12312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28721.exe
        9⤵
        
        PID:15212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2249.exe
        8⤵
        
        PID:9192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60201.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16378.exe
        8⤵
        
        PID:7620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63722.exe
        7⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24035.exe
        8⤵
        
        PID:7968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20745.exe
        9⤵
        
        PID:10040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46466.exe
        8⤵
        
        PID:12356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30930.exe
        8⤵
        
        PID:3304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28913.exe
        8⤵
        
        PID:14960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50961.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-529.exe
        7⤵
        
        PID:12408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60384.exe
        7⤵
        
        PID:14840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15760.exe
        6⤵
        
        PID:4376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-946.exe
        7⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15225.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43689.exe
        8⤵
        
        PID:804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27097.exe
        8⤵
        
        PID:7216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45289.exe
        7⤵
        
        PID:8912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21873.exe
        7⤵
        
        PID:13280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61953.exe
        7⤵
        
        PID:14584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64642.exe
        7⤵
        
        PID:1476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30992.exe
        7⤵
        
        PID:16476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34122.exe
        6⤵
        
        PID:6312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58267.exe
        7⤵
        
        PID:13652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4992.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31632.exe
        6⤵
        
        PID:8464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40865.exe
        6⤵
        
        PID:12372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23313.exe
        6⤵
        
        PID:14744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47370.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54651.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33323.exe
        7⤵
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52363.exe
        8⤵
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13954.exe
        9⤵
        
        PID:11436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28913.exe
        9⤵
        
        PID:3564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37809.exe
        8⤵
        
        PID:9628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17352.exe
        8⤵
        
        PID:13576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46882.exe
        8⤵
        
        PID:14732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56451.exe
        8⤵
        
        PID:5356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7521.exe
        7⤵
        
        PID:7704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4058.exe
        8⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55522.exe
        8⤵
        
        PID:15340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54570.exe
        8⤵
        
        PID:5248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46361.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10441.exe
        7⤵
        
        PID:14816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28913.exe
        7⤵
        
        PID:5044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20577.exe
        6⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27859.exe
        7⤵
        
        PID:6300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54795.exe
        8⤵
        
        PID:11620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28913.exe
        8⤵
        
        PID:2176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37233.exe
        7⤵
        
        PID:9596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-824.exe
        7⤵
        
        PID:13540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32331.exe
        7⤵
        
        PID:4456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14048.exe
        6⤵
        
        PID:7604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54131.exe
        7⤵
        
        PID:11268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23248.exe
        7⤵
        
        PID:5944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38849.exe
        6⤵
        
        PID:11324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39849.exe
        6⤵
        
        PID:2852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23313.exe
        6⤵
        
        PID:1660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48329.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40147.exe
        6⤵
        
        PID:5020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63546.exe
        7⤵
        
        PID:7440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6938.exe
        8⤵
        
        PID:11376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28913.exe
        8⤵
        
        PID:2540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4176.exe
        7⤵
        
        PID:10420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3041.exe
        7⤵
        
        PID:14444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47018.exe
        6⤵
        
        PID:7400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4176.exe
        6⤵
        
        PID:10412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3041.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44163.exe
        6⤵
        
        PID:5776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56706.exe
        5⤵
        
        PID:6036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53899.exe
        6⤵
        
        PID:7000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6938.exe
        7⤵
        
        PID:11444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25728.exe
        7⤵
        
        PID:15024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12577.exe
        7⤵
        
        PID:3708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55298.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37145.exe
        6⤵
        
        PID:13556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38497.exe
        6⤵
        
        PID:15256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57312.exe
        6⤵
        
        PID:14452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45649.exe
        5⤵
        
        PID:8040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11265.exe
        5⤵
        
        PID:11044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21289.exe
        5⤵
        
        PID:6648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52458.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52458.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1698.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37931.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48891.exe
        7⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26323.exe
        8⤵
        
        PID:6920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48155.exe
        9⤵
        
        PID:8748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53866.exe
        9⤵
        
        PID:12676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6202.exe
        9⤵
        
        PID:17336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28960.exe
        8⤵
        
        PID:9988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49554.exe
        8⤵
        
        PID:1420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13306.exe
        8⤵
        
        PID:7128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64314.exe
        7⤵
        
        PID:6584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45402.exe
        7⤵
        
        PID:10900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19113.exe
        7⤵
        
        PID:2688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12409.exe
        6⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34979.exe
        7⤵
        
        PID:6472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46627.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51001.exe
        8⤵
        
        PID:13472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62162.exe
        8⤵
        
        PID:1476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49818.exe
        7⤵
        
        PID:9456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27736.exe
        7⤵
        
        PID:13008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65217.exe
        7⤵
        
        PID:14644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58778.exe
        7⤵
        
        PID:15200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13306.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64785.exe
        6⤵
        
        PID:8016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36466.exe
        6⤵
        
        PID:11016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39657.exe
        6⤵
        
        PID:924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58482.exe
        6⤵
        
        PID:5240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34593.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17888.exe
        6⤵
        
        PID:6692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58819.exe
        7⤵
        
        PID:9420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27929.exe
        7⤵
        
        PID:13340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28913.exe
        7⤵
        
        PID:2744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34818.exe
        6⤵
        
        PID:9120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55969.exe
        6⤵
        
        PID:12388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8937.exe
        6⤵
        
        PID:5948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48729.exe
        5⤵
        
        PID:5800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14802.exe
        6⤵
        
        PID:8576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16585.exe
        6⤵
        
        PID:12140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49082.exe
        6⤵
        
        PID:2956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8233.exe
        6⤵
        
        PID:3736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5138.exe
        6⤵
        
        PID:6336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65466.exe
        5⤵
        
        PID:8616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46627.exe
        6⤵
        
        PID:11864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54570.exe
        6⤵
        
        PID:13616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27328.exe
        5⤵
        
        PID:12236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6977.exe
        5⤵
        
        PID:14248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10944.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10944.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29955.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61963.exe
        6⤵
        
        PID:1604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9114.exe
        7⤵
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28539.exe
        8⤵
        
        PID:7548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33467.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:12472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25064.exe
        9⤵
        
        PID:14372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5568.exe
        9⤵
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39641.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21296.exe
        8⤵
        
        PID:14348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4409.exe
        8⤵
        
        PID:4748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19529.exe
        7⤵
        
        PID:6236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30600.exe
        7⤵
        
        PID:11036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19113.exe
        7⤵
        
        PID:3660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47194.exe
        6⤵
        
        PID:6288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24035.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33410.exe
        7⤵
        
        PID:14216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24448.exe
        7⤵
        
        PID:4888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34432.exe
        6⤵
        
        PID:8476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48386.exe
        6⤵
        
        PID:12592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-986.exe
        6⤵
        
        PID:13348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-328.exe
        6⤵
        
        PID:208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62274.exe
        5⤵
        
        PID:5232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7874.exe
        6⤵
        
        PID:6588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1450.exe
        7⤵
        
        PID:9396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13129.exe
        7⤵
        
        PID:14060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59770.exe
        7⤵
        
        PID:8108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14065.exe
        6⤵
        
        PID:8324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64633.exe
        6⤵
        
        PID:13120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29451.exe
        6⤵
        
        PID:6348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47961.exe
        5⤵
        
        PID:552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17299.exe
        6⤵
        
        PID:8712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46435.exe
        7⤵
        
        PID:10740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45979.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50986.exe
        6⤵
        
        PID:11496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13306.exe
        6⤵
        
        PID:3332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9161.exe
        5⤵
        
        PID:7696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38289.exe
        5⤵
        
        PID:12980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13985.exe
        5⤵
        
        PID:14524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11329.exe
        5⤵
        
        PID:5712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62554.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62554.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39379.exe
        5⤵
        
        PID:5180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16043.exe
        6⤵
        
        PID:6484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51427.exe
        7⤵
        
        PID:9108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29953.exe
        7⤵
        
        PID:13364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8600.exe
        7⤵
        
        PID:15880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14065.exe
        6⤵
        
        PID:7944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64633.exe
        6⤵
        
        PID:13112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62891.exe
        6⤵
        
        PID:4388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9145.exe
        5⤵
        
        PID:6744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34827.exe
        6⤵
        
        PID:14708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55250.exe
        6⤵
        
        PID:14172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48249.exe
        6⤵
        
        PID:5292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52890.exe
        5⤵
        
        PID:7192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24936.exe
        5⤵
        
        PID:13924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39160.exe
        5⤵
        
        PID:16640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31512.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31512.exe
      4⤵
      PID:5880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56027.exe
        5⤵
        
        PID:8212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43481.exe
        5⤵
        
        PID:11580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22264.exe
        5⤵
        
        PID:14864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29451.exe
        5⤵
        
        PID:6388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29705.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29705.exe
      4⤵
      PID:8796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20842.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20842.exe
      4⤵
      PID:12232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20274.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20274.exe
      4⤵
      PID:14356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17953.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17953.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48779.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48779.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33987.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59555.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5642.exe
        7⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56706.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40563.exe
        9⤵
        
        PID:8528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28785.exe
        9⤵
        
        PID:12576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53418.exe
        9⤵
        
        PID:7080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7624.exe
        8⤵
        
        PID:2588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-529.exe
        8⤵
        
        PID:12400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64153.exe
        8⤵
        
        PID:14744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24448.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29321.exe
        7⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58523.exe
        8⤵
        
        PID:6996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26345.exe
        9⤵
        
        PID:9264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14753.exe
        8⤵
        
        PID:10172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63098.exe
        8⤵
        
        PID:3904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65481.exe
        8⤵
        
        PID:15332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55849.exe
        7⤵
        
        PID:8156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19433.exe
        8⤵
        
        PID:16452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36466.exe
        7⤵
        
        PID:11000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23505.exe
        7⤵
        
        PID:5536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34977.exe
        6⤵
        
        PID:2268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56706.exe
        7⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33931.exe
        8⤵
        
        PID:8288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2849.exe
        8⤵
        
        PID:13064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12385.exe
        8⤵
        
        PID:1752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7624.exe
        7⤵
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-529.exe
        7⤵
        
        PID:12440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24448.exe
        7⤵
        
        PID:2708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10960.exe
        6⤵
        
        PID:5460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42675.exe
        7⤵
        
        PID:9288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4001.exe
        7⤵
        
        PID:12504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61586.exe
        7⤵
        
        PID:6828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13105.exe
        6⤵
        
        PID:9096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22424.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19113.exe
        6⤵
        
        PID:5148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8553.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19971.exe
        6⤵
        
        PID:4608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7578.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42187.exe
        8⤵
        
        PID:852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45946.exe
        9⤵
        
        PID:6492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56170.exe
        8⤵
        
        PID:10272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62713.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43625.exe
        8⤵
        
        PID:15604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58258.exe
        7⤵
        
        PID:8172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30600.exe
        7⤵
        
        PID:10928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12361.exe
        7⤵
        
        PID:14924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18921.exe
        7⤵
        
        PID:1112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13945.exe
        6⤵
        
        PID:5404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15378.exe
        7⤵
        
        PID:8036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43481.exe
        7⤵
        
        PID:11564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21474.exe
        7⤵
        
        PID:3052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40681.exe
        6⤵
        
        PID:8840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46627.exe
        7⤵
        
        PID:11612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29610.exe
        8⤵
        
        PID:6324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28913.exe
        7⤵
        
        PID:1736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31474.exe
        6⤵
        
        PID:11552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23696.exe
        6⤵
        
        PID:15176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24448.exe
        6⤵
        
        PID:13948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62849.exe
        5⤵
        
        PID:4584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50339.exe
        6⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32203.exe
        7⤵
        
        PID:7776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57914.exe
        7⤵
        
        PID:14324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3130.exe
        7⤵
        
        PID:15852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43089.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60201.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39762.exe
        6⤵
        
        PID:2884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29643.exe
        6⤵
        
        PID:14964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17785.exe
        5⤵
        
        PID:6224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54795.exe
        6⤵
        
        PID:11636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12577.exe
        6⤵
        
        PID:14884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31824.exe
        5⤵
        
        PID:8344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40865.exe
        5⤵
        
        PID:12432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39841.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22865.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33899.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54843.exe
        6⤵
        
        PID:4232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6426.exe
        7⤵
        
        PID:5552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26323.exe
        8⤵
        
        PID:6936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39795.exe
        9⤵
        
        PID:8924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53674.exe
        9⤵
        
        PID:12716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53418.exe
        9⤵
        
        PID:6864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28960.exe
        8⤵
        
        PID:9648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49554.exe
        8⤵
        
        PID:13328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52523.exe
        8⤵
        
        PID:1812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14537.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48731.exe
        8⤵
        
        PID:8432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33410.exe
        8⤵
        
        PID:13692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48313.exe
        8⤵
        
        PID:15104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60691.exe
        8⤵
        
        PID:16620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10320.exe
        7⤵
        
        PID:9668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8609.exe
        7⤵
        
        PID:13752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49144.exe
        7⤵
        
        PID:7024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21153.exe
        6⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6634.exe
        7⤵
        
        PID:8508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48057.exe
        8⤵
        
        PID:6840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24369.exe
        7⤵
        
        PID:11972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4946.exe
        7⤵
        
        PID:15724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15984.exe
        6⤵
        
        PID:9200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-529.exe
        6⤵
        
        PID:11544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40976.exe
        6⤵
        
        PID:6812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10857.exe
        5⤵
        
        PID:2916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55627.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36027.exe
        7⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60955.exe
        8⤵
        
        PID:12192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27753.exe
        8⤵
        
        PID:15124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31072.exe
        7⤵
        
        PID:9884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49938.exe
        7⤵
        
        PID:13432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58585.exe
        7⤵
        
        PID:15028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62058.exe
        7⤵
        
        PID:15104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35803.exe
        7⤵
        
        PID:16660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37889.exe
        6⤵
        
        PID:7820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45018.exe
        6⤵
        
        PID:10988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6977.exe
        6⤵
        
        PID:14644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11344.exe
        5⤵
        
        PID:5636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5570.exe
        6⤵
        
        PID:7236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55283.exe
        7⤵
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43810.exe
        7⤵
        
        PID:14596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10656.exe
        7⤵
        
        PID:4152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60161.exe
        7⤵
        
        PID:7612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48194.exe
        6⤵
        
        PID:11108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63097.exe
        6⤵
        
        PID:15048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7920.exe
        6⤵
        
        PID:1548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5601.exe
        5⤵
        
        PID:8132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54674.exe
        6⤵
        
        PID:17308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38657.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10289.exe
        5⤵
        
        PID:15596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3648.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3648.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14194.exe
        5⤵
        
        PID:4940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31123.exe
        6⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51403.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24035.exe
        8⤵
        
        PID:7660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60497.exe
        8⤵
        
        PID:13936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4889.exe
        8⤵
        
        PID:14716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11113.exe
        8⤵
        
        PID:15080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61930.exe
        7⤵
        
        PID:9540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25136.exe
        7⤵
        
        PID:13464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29643.exe
        7⤵
        
        PID:14720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48362.exe
        6⤵
        
        PID:8780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62497.exe
        6⤵
        
        PID:11872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30409.exe
        6⤵
        
        PID:15048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23313.exe
        6⤵
        
        PID:5128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20577.exe
        5⤵
        
        PID:5912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18347.exe
        6⤵
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24035.exe
        7⤵
        
        PID:7972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46466.exe
        7⤵
        
        PID:12340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28721.exe
        7⤵
        
        PID:6824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55674.exe
        6⤵
        
        PID:9372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41665.exe
        6⤵
        
        PID:13320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5138.exe
        6⤵
        
        PID:14392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4536.exe
        5⤵
        
        PID:7664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7408.exe
        6⤵
        
        PID:14440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59242.exe
        5⤵
        
        PID:10456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18496.exe
        5⤵
        
        PID:14588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62507.exe
        5⤵
        
        PID:3916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63130.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63130.exe
      4⤵
      PID:1468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6426.exe
        5⤵
        
        PID:5556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51403.exe
        6⤵
        
        PID:6200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51427.exe
        7⤵
        
        PID:8920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29953.exe
        7⤵
        
        PID:13288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45449.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4753.exe
        6⤵
        
        PID:9652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27632.exe
        6⤵
        
        PID:13724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21474.exe
        6⤵
        
        PID:14788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37889.exe
        5⤵
        
        PID:7900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31267.exe
        6⤵
        
        PID:13480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5568.exe
        6⤵
        
        PID:5400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36850.exe
        5⤵
        
        PID:11152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38747.exe
        5⤵
        
        PID:14392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35096.exe
        5⤵
        
        PID:15108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19113.exe
        5⤵
        
        PID:5136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41409.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41409.exe
      4⤵
      PID:5756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41907.exe
        5⤵
        
        PID:9048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4665.exe
        5⤵
        
        PID:12764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28913.exe
        5⤵
        
        PID:1568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37489.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37489.exe
      4⤵
      PID:9144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57931.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57931.exe
      4⤵
      PID:12392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28250.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28250.exe
      4⤵
      PID:14756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18144.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18144.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42539.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42539.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29379.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54947.exe
        6⤵
        
        PID:2492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33531.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34507.exe
        8⤵
        
        PID:9312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61370.exe
        8⤵
        
        PID:12656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53418.exe
        8⤵
        
        PID:6364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44786.exe
        5⤵
        
        PID:1156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1050.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63650.exe
        6⤵
        
        PID:9464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6985.exe
        6⤵
        
        PID:14112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57696.exe
        6⤵
        
        PID:14796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60753.exe
        5⤵
        
        PID:7380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10041.exe
        5⤵
        
        PID:10620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2544.exe
        5⤵
        
        PID:14564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40976.exe
        5⤵
        
        PID:7048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34209.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34209.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61963.exe
        5⤵
        
        PID:3796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49099.exe
        6⤵
        
        PID:6508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65259.exe
        7⤵
        
        PID:8260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28785.exe
        7⤵
        
        PID:12600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17089.exe
        7⤵
        
        PID:15120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28721.exe
        7⤵
        
        PID:5832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14065.exe
        6⤵
        
        PID:8244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16584.exe
        6⤵
        
        PID:13040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46171.exe
        6⤵
        
        PID:5896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33841.exe
        5⤵
        
        PID:6480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8466.exe
        6⤵
        
        PID:8496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2849.exe
        6⤵
        
        PID:13088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58945.exe
        5⤵
        
        PID:9792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32730.exe
        5⤵
        
        PID:14052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11584.exe
        5⤵
        
        PID:14824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19113.exe
        5⤵
        
        PID:1792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33824.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33824.exe
      4⤵
      PID:2628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13473.exe
        5⤵
        
        PID:6980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55947.exe
        6⤵
        
        PID:11528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54570.exe
        6⤵
        
        PID:5352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20016.exe
        5⤵
        
        PID:9444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14857.exe
        5⤵
        
        PID:13380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24448.exe
        5⤵
        
        PID:2692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23946.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23946.exe
      4⤵
      PID:6632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6746.exe
        5⤵
        
        PID:11420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28913.exe
        5⤵
        
        PID:3316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26152.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26152.exe
      4⤵
      PID:9092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39433.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39433.exe
      4⤵
      PID:404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59250.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59250.exe
      4⤵
      PID:15364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17769.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17769.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29763.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29763.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40147.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7874.exe
        6⤵
        
        PID:6524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48249.exe
        7⤵
        
        PID:14992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14065.exe
        6⤵
        
        PID:8032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16584.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50208.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17313.exe
        5⤵
        
        PID:6688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54795.exe
        6⤵
        
        PID:11504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28913.exe
        6⤵
        
        PID:4408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58753.exe
        5⤵
        
        PID:9840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59538.exe
        5⤵
        
        PID:14284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29643.exe
        5⤵
        
        PID:14256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53338.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53338.exe
      4⤵
      PID:5408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26043.exe
        5⤵
        
        PID:7480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56819.exe
        6⤵
        
        PID:12628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28920.exe
        6⤵
        
        PID:5480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39641.exe
        5⤵
        
        PID:10468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49144.exe
        5⤵
        
        PID:15028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24520.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24520.exe
      4⤵
      PID:7672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45786.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45786.exe
      4⤵
      PID:10384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23313.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23313.exe
      4⤵
      PID:2868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45529.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45529.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48315.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48315.exe
      4⤵
      PID:4644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25363.exe
        5⤵
        
        PID:7120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44131.exe
        6⤵
        
        PID:9880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45979.exe
        6⤵
        
        PID:1292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63650.exe
        5⤵
        
        PID:9472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6985.exe
        5⤵
        
        PID:14264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29643.exe
        5⤵
        
        PID:3172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57193.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57193.exe
      4⤵
      PID:7388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45786.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45786.exe
      4⤵
      PID:10312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23313.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23313.exe
      4⤵
      PID:2396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7281.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7281.exe
    3⤵
    PID:5436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26323.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26323.exe
      4⤵
      PID:6928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40563.exe
        5⤵
        
        PID:8540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28785.exe
        5⤵
        
        PID:12608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28913.exe
        5⤵
        
        PID:4724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30977.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30977.exe
      4⤵
      PID:9268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17736.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17736.exe
      4⤵
      PID:12492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29835.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29835.exe
      4⤵
      PID:6664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-922.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-922.exe
    3⤵
    PID:6740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53696.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53696.exe
    3⤵
    PID:10044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64138.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64138.exe
    3⤵
    PID:13076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36449.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36449.exe
    3⤵
    PID:15040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25145.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25145.exe
    3⤵
    PID:16464
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49754.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49754.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1500
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29651.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29651.exe
    3⤵
    - Executes dropped EXE
    PID:432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45058.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45058.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16115.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16115.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12938.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39275.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48699.exe
        7⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-666.exe
        8⤵
        
        PID:6948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49307.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:8228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50898.exe
        9⤵
        
        PID:13104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21129.exe
        9⤵
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28960.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18889.exe
        8⤵
        
        PID:13640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60145.exe
        8⤵
        
        PID:14460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64314.exe
        7⤵
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63553.exe
        7⤵
        
        PID:9392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33602.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31008.exe
        7⤵
        
        PID:14992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45979.exe
        7⤵
        
        PID:5140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21153.exe
        6⤵
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10586.exe
        7⤵
        
        PID:10220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29953.exe
        7⤵
        
        PID:12368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33808.exe
        7⤵
        
        PID:14784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29304.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24152.exe
        6⤵
        
        PID:9172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32371.exe
        7⤵
        
        PID:5476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-529.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5440.exe
        6⤵
        
        PID:15084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16664.exe
        6⤵
        
        PID:5648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44106.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17888.exe
        6⤵
        
        PID:6700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26851.exe
        7⤵
        
        PID:14768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28721.exe
        7⤵
        
        PID:7052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34818.exe
        6⤵
        
        PID:9044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55969.exe
        6⤵
        
        PID:12536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43617.exe
        6⤵
        
        PID:5700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56897.exe
        5⤵
        
        PID:5784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53323.exe
        6⤵
        
        PID:5792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6673.exe
        6⤵
        
        PID:10112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43689.exe
        6⤵
        
        PID:13356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13690.exe
        6⤵
        
        PID:5488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39130.exe
        5⤵
        
        PID:7072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27800.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28826.exe
        5⤵
        
        PID:5952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24785.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24785.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47443.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31123.exe
        6⤵
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20267.exe
        7⤵
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22315.exe
        8⤵
        
        PID:11820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50809.exe
        8⤵
        
        PID:1808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6905.exe
        8⤵
        
        PID:3852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5329.exe
        7⤵
        
        PID:10080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59449.exe
        7⤵
        
        PID:13644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53610.exe
        7⤵
        
        PID:6360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19529.exe
        6⤵
        
        PID:7016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30600.exe
        6⤵
        
        PID:10916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19113.exe
        6⤵
        
        PID:4996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20000.exe
        5⤵
        
        PID:6748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6554.exe
        6⤵
        
        PID:10856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53610.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34818.exe
        5⤵
        
        PID:9188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55969.exe
        5⤵
        
        PID:12320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52361.exe
        5⤵
        
        PID:4728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9024.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9024.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33323.exe
        5⤵
        
        PID:5316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45923.exe
        6⤵
        
        PID:6944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65179.exe
        7⤵
        
        PID:12524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12584.exe
        7⤵
        
        PID:3948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45017.exe
        6⤵
        
        PID:9388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33602.exe
        6⤵
        
        PID:13740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58585.exe
        6⤵
        
        PID:15044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51050.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30600.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4385.exe
        5⤵
        
        PID:14968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19113.exe
        5⤵
        
        PID:2864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-681.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-681.exe
      4⤵
      PID:5268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50355.exe
        5⤵
        
        PID:6668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6746.exe
        6⤵
        
        PID:11452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28913.exe
        6⤵
        
        PID:8900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6585.exe
        5⤵
        
        PID:10260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61025.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61025.exe
      4⤵
      PID:8188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11265.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11265.exe
      4⤵
      PID:10908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10625.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10625.exe
      4⤵
      PID:2156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35064.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35064.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36483.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36483.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63971.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29513.exe
        6⤵
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54211.exe
        7⤵
        
        PID:9076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46466.exe
        7⤵
        
        PID:12348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1416.exe
        7⤵
        
        PID:14732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53610.exe
        7⤵
        
        PID:6372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26458.exe
        6⤵
        
        PID:9512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6192.exe
        6⤵
        
        PID:13368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-210.exe
        6⤵
        
        PID:14952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21256.exe
        6⤵
        
        PID:15120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17297.exe
        6⤵
        
        PID:16424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53634.exe
        5⤵
        
        PID:5984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18347.exe
        6⤵
        
        PID:6272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54795.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28913.exe
        7⤵
        
        PID:15092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52994.exe
        6⤵
        
        PID:9688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60113.exe
        6⤵
        
        PID:13780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57312.exe
        6⤵
        
        PID:14792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21256.exe
        5⤵
        
        PID:7632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27027.exe
        6⤵
        
        PID:10368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48978.exe
        6⤵
        
        PID:14424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35272.exe
        6⤵
        
        PID:15752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37985.exe
        5⤵
        
        PID:10936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16250.exe
        5⤵
        
        PID:15112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-161.exe
        5⤵
        
        PID:14696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59058.exe
        5⤵
        
        PID:15404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52082.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52082.exe
      4⤵
      Executes dropped EXE
      PID:400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31123.exe
        5⤵
        
        PID:5628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12290.exe
        6⤵
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6746.exe
        7⤵
        
        PID:11356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28913.exe
        7⤵
        
        PID:15012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5329.exe
        6⤵
        
        PID:10096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59449.exe
        6⤵
        
        PID:13668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1345.exe
        6⤵
        
        PID:4280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19529.exe
        5⤵
        
        PID:6800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61929.exe
        5⤵
        
        PID:11116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2969.exe
        5⤵
        
        PID:14920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34312.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34312.exe
      4⤵
      PID:5888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33827.exe
        5⤵
        
        PID:7328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6938.exe
        6⤵
        
        PID:11412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55626.exe
        6⤵
        
        PID:2956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28913.exe
        6⤵
        
        PID:1948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55978.exe
        5⤵
        
        PID:10392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62713.exe
        5⤵
        
        PID:14408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27648.exe
        5⤵
        
        PID:924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38170.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38170.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34624.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34624.exe
      4⤵
      PID:11144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60922.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60922.exe
      4⤵
      PID:5548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19881.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19881.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30915.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30915.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31123.exe
        5⤵
        
        PID:5612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36027.exe
        6⤵
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60955.exe
        7⤵
        
        PID:12200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20745.exe
        7⤵
        
        PID:14244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37233.exe
        6⤵
        
        PID:9580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-824.exe
        6⤵
        
        PID:13532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29643.exe
        6⤵
        
        PID:14260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32016.exe
        5⤵
        
        PID:8600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62786.exe
        5⤵
        
        PID:13048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32057.exe
        5⤵
        
        PID:3704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62762.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62762.exe
      4⤵
      PID:5444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28731.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16865.exe
        5⤵
        
        PID:10940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-986.exe
        5⤵
        
        PID:4556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57696.exe
        5⤵
        
        PID:14304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54417.exe
      4⤵
      PID:3952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38002.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38002.exe
      4⤵
      PID:10696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7169.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7169.exe
      4⤵
      PID:14952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38513.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38513.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57059.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57059.exe
      4⤵
      PID:5372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18539.exe
        5⤵
        
        PID:5576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39803.exe
        6⤵
        
        PID:11364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12577.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37233.exe
        5⤵
        
        PID:9588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-824.exe
        5⤵
        
        PID:13524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63218.exe
        5⤵
        
        PID:15240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11113.exe
        5⤵
        
        PID:3748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13576.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13576.exe
      4⤵
      PID:7724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37883.exe
        5⤵
        
        PID:10340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48506.exe
        5⤵
        
        PID:2324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45787.exe
        5⤵
        
        PID:6844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53186.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53186.exe
      4⤵
      PID:10904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-920.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-920.exe
      4⤵
      PID:15352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51785.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51785.exe
      4⤵
      PID:1920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48033.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48033.exe
    3⤵
    PID:6004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41995.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41995.exe
      4⤵
      PID:7316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64323.exe
        5⤵
        
        PID:13612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27281.exe
        5⤵
        
        PID:3972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55978.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55978.exe
      4⤵
      PID:10404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62713.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62713.exe
      4⤵
      PID:14416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18737.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18737.exe
      4⤵
      PID:16628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38779.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38779.exe
    3⤵
    PID:7488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37280.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37280.exe
      4⤵
      PID:5676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16120.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16120.exe
    3⤵
    PID:10380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41786.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41786.exe
    3⤵
    PID:3096
- C:\Users\Admin\AppData\Local\Temp\Unicorn-936.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-936.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6786.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6786.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18035.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18035.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37931.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3664.exe
        6⤵
        
        PID:6872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38371.exe
        7⤵
        
        PID:11276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8624.exe
        7⤵
        
        PID:14464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53418.exe
        7⤵
        
        PID:2624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27034.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47609.exe
        6⤵
        
        PID:12328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2585.exe
        6⤵
        
        PID:1808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12601.exe
        5⤵
        
        PID:6052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43427.exe
        6⤵
        
        PID:6656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44634.exe
        6⤵
        
        PID:9756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36185.exe
        6⤵
        
        PID:13876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19466.exe
        6⤵
        
        PID:16396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21448.exe
        5⤵
        
        PID:7848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56515.exe
        6⤵
        
        PID:8196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46466.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6202.exe
        6⤵
        
        PID:17328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1185.exe
        5⤵
        
        PID:9404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38865.exe
        5⤵
        
        PID:13332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2585.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26425.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48315.exe
        5⤵
        
        PID:3104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33531.exe
        6⤵
        
        PID:7108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20499.exe
        7⤵
        
        PID:11840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28913.exe
        7⤵
        
        PID:4752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55482.exe
        6⤵
        
        PID:9492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8992.exe
        6⤵
        
        PID:13400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17489.exe
        6⤵
        
        PID:14168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57193.exe
        5⤵
        
        PID:7372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45786.exe
        5⤵
        
        PID:10328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58673.exe
        5⤵
        
        PID:15256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55985.exe
        5⤵
        
        PID:15672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1832.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1832.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26043.exe
        5⤵
        
        PID:7456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6746.exe
        6⤵
        
        PID:11664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28913.exe
        6⤵
        
        PID:2836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39641.exe
        5⤵
        
        PID:10476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62713.exe
        5⤵
        
        PID:14396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27289.exe
        5⤵
        
        PID:16844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30386.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30386.exe
      4⤵
      PID:7416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45091.exe
        5⤵
        
        PID:10452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28721.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37120.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37120.exe
      4⤵
      PID:10356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61114.exe
      4⤵
      PID:14596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13545.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13545.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54651.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54651.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63146.exe
        5⤵
        
        PID:5296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24035.exe
        6⤵
        
        PID:7580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33410.exe
        6⤵
        
        PID:13972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48313.exe
        6⤵
        
        PID:14940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28721.exe
        6⤵
        
        PID:4896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64609.exe
        5⤵
        
        PID:9112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54795.exe
        6⤵
        
        PID:11512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28913.exe
        6⤵
        
        PID:4604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55018.exe
        5⤵
        
        PID:3376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24448.exe
        5⤵
        
        PID:1780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61802.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61802.exe
      4⤵
      PID:5968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62259.exe
        5⤵
        
        PID:6152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64299.exe
        6⤵
        
        PID:8868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53866.exe
        6⤵
        
        PID:12684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12769.exe
        6⤵
        
        PID:7932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36849.exe
        5⤵
        
        PID:9860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53673.exe
        5⤵
        
        PID:14292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65481.exe
        5⤵
        
        PID:15232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64785.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64785.exe
      4⤵
      PID:8024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36466.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36466.exe
      4⤵
      PID:10968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23313.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23313.exe
      4⤵
      PID:244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48329.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48329.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11833.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11833.exe
      4⤵
      PID:5176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60355.exe
        5⤵
        
        PID:7756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17249.exe
        5⤵
        
        PID:10960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57120.exe
        5⤵
        
        PID:6836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16072.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16072.exe
      4⤵
      PID:8164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47706.exe
      4⤵
      PID:10924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21689.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21689.exe
      4⤵
      PID:7224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14137.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14137.exe
    3⤵
    PID:5640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20459.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20459.exe
      4⤵
      PID:5596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41803.exe
        5⤵
        
        PID:8676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10337.exe
        5⤵
        
        PID:11284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55330.exe
        5⤵
        
        PID:14452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29643.exe
        5⤵
        
        PID:3352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14065.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14065.exe
      4⤵
      PID:7584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41089.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41089.exe
      4⤵
      PID:13000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13114.exe
      4⤵
      PID:5492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30464.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30464.exe
    3⤵
    PID:6976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11265.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11265.exe
    3⤵
    PID:10952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35130.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35130.exe
    3⤵
    PID:14572
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55722.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55722.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59067.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59067.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43987.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43987.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55139.exe
        5⤵
        
        PID:4320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49099.exe
        6⤵
        
        PID:6548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43851.exe
        7⤵
        
        PID:13476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54114.exe
        7⤵
        
        PID:4964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14065.exe
        6⤵
        
        PID:4532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41089.exe
        6⤵
        
        PID:13012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46363.exe
        6⤵
        
        PID:5000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-785.exe
        5⤵
        
        PID:6764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26272.exe
        5⤵
        
        PID:9808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57426.exe
        5⤵
        
        PID:14232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5138.exe
        5⤵
        
        PID:6412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17977.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17977.exe
      4⤵
      PID:5116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41787.exe
        5⤵
        
        PID:5600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52083.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60146.exe
        7⤵
        
        PID:15084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51993.exe
        7⤵
        
        PID:16680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32625.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4576.exe
        6⤵
        
        PID:14832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8112.exe
        6⤵
        
        PID:15580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57210.exe
        5⤵
        
        PID:7740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47321.exe
        5⤵
        
        PID:10876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9585.exe
        5⤵
        
        PID:15324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24448.exe
        5⤵
        
        PID:2308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18080.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18080.exe
      4⤵
      PID:6640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49971.exe
        5⤵
        
        PID:8692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10337.exe
        5⤵
        
        PID:11316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29643.exe
        5⤵
        
        PID:4832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33666.exe
      4⤵
      PID:9168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38289.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38289.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55049.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55049.exe
      4⤵
      PID:6536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42569.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42569.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53795.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53795.exe
      4⤵
      PID:3384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-946.exe
        5⤵
        
        PID:5300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48243.exe
        6⤵
        
        PID:8388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41665.exe
        6⤵
        
        PID:11916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5138.exe
        6⤵
        
        PID:6424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42994.exe
        5⤵
        
        PID:10012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40889.exe
        5⤵
        
        PID:13412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22824.exe
        5⤵
        
        PID:5652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13089.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13089.exe
      4⤵
      PID:6604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55755.exe
        5⤵
        
        PID:10440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54570.exe
        5⤵
        
        PID:14580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10696.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10696.exe
      4⤵
      PID:8744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45802.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45802.exe
      4⤵
      PID:13212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57120.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57120.exe
      4⤵
      PID:6848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1152.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1152.exe
    3⤵
    PID:3524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32571.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47795.exe
        5⤵
        
        PID:13436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45257.exe
        5⤵
        
        PID:6136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14065.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14065.exe
      4⤵
      PID:7772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41089.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41089.exe
      4⤵
      PID:13056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53826.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53826.exe
    3⤵
    PID:6888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28859.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28859.exe
      4⤵
      PID:12012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28913.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28913.exe
      4⤵
      PID:1588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55953.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55953.exe
    3⤵
    PID:9832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34337.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34337.exe
    3⤵
    PID:14300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60922.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60922.exe
    3⤵
    PID:1108
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8144.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8144.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61283.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61283.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36499.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36499.exe
      4⤵
      PID:3896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57355.exe
        5⤵
        
        PID:5992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50355.exe
        6⤵
        
        PID:7020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31912.exe
        7⤵
        
        PID:4056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6585.exe
        6⤵
        
        PID:10252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21296.exe
        6⤵
        
        PID:14544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29451.exe
        6⤵
        
        PID:2152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41921.exe
        5⤵
        
        PID:844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30600.exe
        5⤵
        
        PID:11008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2585.exe
        5⤵
        
        PID:15048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37785.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37785.exe
      4⤵
      PID:6540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34507.exe
        5⤵
        
        PID:9320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61370.exe
        5⤵
        
        PID:12636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12385.exe
        5⤵
        
        PID:6408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27800.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27800.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46954.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46954.exe
      4⤵
      PID:12992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48952.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48952.exe
      4⤵
      PID:5512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49114.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49114.exe
    3⤵
    PID:4028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33811.exe
      4⤵
      PID:5464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31715.exe
        5⤵
        
        PID:8004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43481.exe
        5⤵
        
        PID:11572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21474.exe
        5⤵
        
        PID:1428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26945.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26945.exe
      4⤵
      PID:8860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33776.exe
      4⤵
      PID:11408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45979.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45979.exe
      4⤵
      PID:5204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21048.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21048.exe
    3⤵
    PID:5156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6746.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6746.exe
      4⤵
      PID:11476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20745.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20745.exe
      4⤵
      PID:9984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56826.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56826.exe
    3⤵
    PID:8316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7432.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7432.exe
    3⤵
    PID:12668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35641.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35641.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6184
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27457.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27457.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11610.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11610.exe
    3⤵
    PID:2184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33531.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33531.exe
      4⤵
      PID:7092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4945.exe
        5⤵
        
        PID:9608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17352.exe
        5⤵
        
        PID:13584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46882.exe
        5⤵
        
        PID:1952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55674.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55674.exe
      4⤵
      PID:9380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50985.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50985.exe
      4⤵
      PID:12712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15610.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15610.exe
      4⤵
      PID:5432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54994.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54994.exe
    3⤵
    PID:6504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54795.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54795.exe
      4⤵
      PID:11628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57633.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57633.exe
      4⤵
      PID:15016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28913.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28913.exe
      4⤵
      PID:14832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11960.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11960.exe
    3⤵
    PID:10008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33602.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33602.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58585.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58585.exe
    3⤵
    PID:15052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52523.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52523.exe
    3⤵
    PID:4636
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44243.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44243.exe
  2⤵
  PID:3528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6265.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6265.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41843.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41843.exe
      4⤵
      PID:3732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11265.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11265.exe
      4⤵
      PID:3792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28952.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28952.exe
    3⤵
    PID:8484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64634.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64634.exe
    3⤵
    PID:3404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53593.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53593.exe
    3⤵
    PID:15340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2632.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2632.exe
    3⤵
    PID:2640
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27720.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27720.exe
  2⤵
  PID:6556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54795.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54795.exe
    3⤵
    PID:11600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28913.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28913.exe
    3⤵
    PID:6252
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64202.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64202.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:8256
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39697.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39697.exe
  2⤵
  PID:13096
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5345.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5345.exe
  2⤵
  PID:14944
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17905.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17905.exe
  2⤵
  PID:4392

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:6092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10944.exe

Filesize
468KB

MD5
1ccf2d17c56a0a79b9cf16b6dd9a4242

SHA1
db4406a995b15f453d7ec9612ca3480d3dd482f8

SHA256
97635279a499374ee55061f62105300192f3072d488e913acadf5a24a9235025

SHA512
c35ee9ee12b90023b54fdbd8bd6b25088f1b24ec71cb19217bda1b88483b102ac72b028d8d4e52a702255f3a935ffb82ac237de78c0c4b8aa4746aed43be5115

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12250.exe

Filesize
468KB

MD5
996405649b2d53e3a4ed9d86108d100a

SHA1
9feca88e7cfa85b8b997890f34171c4ed5bb15d7

SHA256
a514d5495bf7d5a7d9eb251edd1fee8d7da5d663d02309ceef4ffe9ea0f3872c

SHA512
9a15f5b1958253261a6c360d861915249eec7a3064ce4c5e5c86b4317da155138c2b9a833ad2825bf2101bdb72270b0caef3a99140f417cdfcdd8d1b63df26c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12938.exe

Filesize
468KB

MD5
f44c662c3d96bc3ab9d94ecfc57c3811

SHA1
52613ab7df031480e7667e7361c1c2c0eb972800

SHA256
45b2e4f216c06bf8269deb2cf4868ef649212e5148cbb74993662b83814f907c

SHA512
addf55253135ad32d58dbb8f5a48d8bc3e3a1c0a407b8ad053e15b5d61c318d4d48d1686381e63a0e2cd2f1ef41bf387e7e5cecfac6a6ae2bbf2fdb7ce034a3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13545.exe

Filesize
468KB

MD5
6784242041a12243fa32b06488bd942c

SHA1
70fa55ea7def97ab64d6a256afb4778b297d37ff

SHA256
59047ec72aeb843b95de57ab6516620ba9d32084ce30f7bbc7b7e6f17c6d91d3

SHA512
d0d43002ff6da6f4afdc4b276503a004d0fa043cf8aca636b6673df26f637dad716fd5c85ffe9cbfc621c1b91096709d1e6c6389d97e2db92358bb203a99eb87

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16115.exe

Filesize
468KB

MD5
edd5dae464dba4399ad0c81ce534d5d1

SHA1
7173115578c673cb4d89e53023ccf1aa9dced8e2

SHA256
6bd8370cdc7607a3b055626d52db87f3d0bb26314e6fe3d3951f235f37c043d0

SHA512
a8106035dd65f314bb98d4fd7794507b00b78c0b9986274aff43852a2d93d3fdcc7a4ab18cd6346c05d00419317a8f595546b6d2f6bf5ae7faf2881b198c32e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1698.exe

Filesize
468KB

MD5
170a81cccfa2c359d601b9010cf56e6b

SHA1
600e69949de61fc41cf75c5a95fb707173763bce

SHA256
f90d82267746a0fc947f3057a9b78ce1ebc11c0467b512598486fc7cb58457c1

SHA512
557c40bbaa4781bcad30891016076c39a1e4364484630286004ddc695b99f3073d5a8144c5de49d0f1bdfebc1f7bef22aabd69f497874dc8112370008a30c9b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17769.exe

Filesize
468KB

MD5
715cb4cf72c84ea3f3969e1cdc8d9f3b

SHA1
3b92309847925982534ac769765d125f67a02876

SHA256
ea9a742442caaa2c449932d55ba988b4871d03dbf8b28deaaec2cd92f331e3a8

SHA512
dc5b03cca4caebbd7e048456cb240e4ea558abbb7fb5786ee9e45104d96401994902de85bad0eed237318d38d5f8144a8de6e5c13a9401f4caa88f96c02207e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17953.exe

Filesize
468KB

MD5
7011bb024504b9c09959face8841d17d

SHA1
8ea08d5c12fd15656501f45385e9a0beabc81fd3

SHA256
f06c115cb27be2220d370e1bf7f4e20c4daa93d17f67f0d6277e07ffac58bee4

SHA512
9616fe930361e9d935765e427ea9cb4067f9260753863656e7721c5d660733a392bd58e0e3ee02aa25c6272db96d67fa0682622cad239e41d5b9caec6f3dbaff

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18035.exe

Filesize
468KB

MD5
abf7206c54da5d9ff5db09607f005cb4

SHA1
6dad330031e024c6c888f5a9bfb0f511960f3553

SHA256
5414a14842cb32a55ca8ab0932c9446885be1e59d5d0b67f25ff27f441c7bc9f

SHA512
5c246be1257a7ff7e3aad82bbdfa3df8d2601400fd063dc0f6ae1ddd69429381ec19506a2c11e972e1dfbdfc780fecd31a052301f95882136a94efc5c178a536

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18144.exe

Filesize
468KB

MD5
0c058f5687f9504cabb4a3b06db8c31f

SHA1
8abe293bc18fe934ddec729c22ea5a44dffa2777

SHA256
3c7110eb21ec76d39ec8993fdcc3c7b98a7ae1932ffd17a414fd8d39a4bbc773

SHA512
9a8621bb7ce7a1808e3a96bf0a75728080612ed886c44990dad2b8e5fa65e4700ac34359287d75785f9daf79bfc2dadc981e5aeae67de9c9225aa6dce148dc82

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19881.exe

Filesize
468KB

MD5
aa180ac272407f7b0ea84bf1a06ccf86

SHA1
16a4cffe0d44c7ca0b8e632327b666b6afc5fe61

SHA256
8a05af107f820ed42577b5ef446db3cf1220ce56ccdbc3ba4b54634179c857a0

SHA512
c5c371d208872e8850ea0af7852151912117837400281bd1f184844d663a7e5da984799c139e300d4548ab5c20f48e0432a35004cbf1a0cea60fdb575cc1b848

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20123.exe

Filesize
468KB

MD5
b8cd06b002db51bf7cccd98257bc9d93

SHA1
cb83ab78ce1559770fb52113e158bdf46565f720

SHA256
b0bd6b6b8fee2bd2e6ef07b23ceba58bf7f90f065118f2b913c9523c76a4cd1d

SHA512
fab543bf86bf65817966d53264620438883d22e8ad0e975bbb5d912027075d641b5bd57cb17b114c3c94d10c618373d6f2142a52efd4d20c801841b79167b49a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22865.exe

Filesize
468KB

MD5
fdb2f1b3a42057b7c89bfe477dc0bde9

SHA1
106f03df1bde96fb42553d48b0c5eaa42b1cce4b

SHA256
288138fe2efd5d2f788c671f90d22c531c2dc16b36988183ecb09f270b9a3227

SHA512
93d8eaeae55745fd85fb97153c4ee5bdf03102878a407411864723893afdfb42888600e639a897ed516a77ec4ad687bb5e6aabaf982122a877856f98f5f60fa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24275.exe

Filesize
468KB

MD5
0d4e31354a8afbde84b48f14b5556fe4

SHA1
238f1b4c37ce32dc2122ac507d850918c63e9ca8

SHA256
08020b5e558caa4b25e8a7592d3661570eccc04e4bace51723bc0386e780d3ca

SHA512
f9204221654fa72c4a916d35e2ffb19e2457dce26942d5d1eb6eaf0c2faf0007566210565137dd7bd2bf5676a8150317a0e5ef8ee38bfd9574cbb466b1945963

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24785.exe

Filesize
468KB

MD5
15710cdbe556aac7b98cf8b19aa8c024

SHA1
191035c8db34b33ddcb610f27594d102a5007024

SHA256
815025c8d11de8ad2a74ee8851c9080680f2bb999d0518dc508b67588da02069

SHA512
9e9581b750af1a59677700068a8b7becc4a2d547b785c2ea7922b7829a95f3b3bce64a228c067dba06d0b07dfa46df1175bbdf2a0913eb5ca18490446d8e36f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29651.exe

Filesize
468KB

MD5
7d50f8641ce71d8a6289d5ba5827bbfd

SHA1
8d3d1f7675ce32876e52d4698efe60efb2c0225a

SHA256
5618447f9773dc9a91b51ea9cb0a705645af8498641141a5be24bba92bc73694

SHA512
ac29038b756d877c3894ce061bccbb49204dd2debc085415feaa8e7a48905456946f813615e18b24b0157f3dc6fc89c6c1caf7aa73fa4321fbd7194078ab7681

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32729.exe

Filesize
468KB

MD5
85c12ee70df3b5b97762f7cae79b010c

SHA1
500b8bd760f9c0d5e0d9617f1d2b53ea1c357bc1

SHA256
434f6ac0fb59a5abc1740507d5f98319d3693f628b3a7b4f253e134ab92e976f

SHA512
4b8563b63d77a6d8ccdb2128b3b920dc3c24b36c4992c3892b381b9c85297af207ec613affac2c6b5577b5c5c74bbc9e13590c61a5960fa484d8e2be583fbbac

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33987.exe

Filesize
468KB

MD5
31c020af13c52d78a0b3f8773db5723b

SHA1
887bdca545e190497e21993a15e675fb0f9471d0

SHA256
d2533d8c7385068a4a3e0ac5f905d8a76993e64fe9be019b806452573c91d24f

SHA512
aefd3931a021aa2727d2ad9731cbcae3e7b4a7ca52c4c42faea37dfbc164e30268e6d8b7b4ce41acf8c747cc2e4309ddb8bdfd07903231ddf8b98e06cd3d08ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35064.exe

Filesize
468KB

MD5
06854ed96315775434cc7f7210dcc079

SHA1
57567ca1525047436796e35bc399b6a8d044ed0e

SHA256
6f8d2327729b0bbff80ee0954db26050acc7fe62dbf0ee7f4c73a6a1296179e1

SHA512
db7a678e37a4b11725dfe523fbd6a73877fe6b6af1c79a37d6216604c42369e4f2f75b2f02267d14874eace0892bf71308671c1fce3d14095d560c9c34a0b003

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36483.exe

Filesize
468KB

MD5
39f4db9585babbc4d0f303d2f5da7a92

SHA1
363d2f1803cc44a94cf02cc427410dbe896d0713

SHA256
d1ff232d799cfdf37cd8589930eea3d4ebf8bae12f638b98a3641aa26fc46706

SHA512
a27ff95e4fd86ce182158ecb758337672bc9c9d2bb49025cf639f326fcd126a32f085021bb0f7396a9e2c42a5d18cfb950000873476379be39d3d27f12bb8809

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42539.exe

Filesize
468KB

MD5
5596d6fbe2c8165a02a1e5f617f9e491

SHA1
c254a47f22f77a83b459d8ce99683dc98fcd0abc

SHA256
61e1c080a3484152041d10450744de0d9b56773dc01c2ddf3ceaef44008bcdfa

SHA512
7a14de482af1f1f70ef9478aa358f32b6244b8c51a91892789a2999014dbab25524872048e48923d27012213331f4f1bf1bad6149847858c64f82abf96be7e32

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43810.exe

Filesize
468KB

MD5
45a74b91d26a911a500cc26a70ef6d78

SHA1
db5a71de9253a393e1e95b51204a5024a4b3c81d

SHA256
f8399415726d381e1b006a562e8e9538a0d8bb380ecf7698402366dc06f8b937

SHA512
79a66cbbe4add86f1d6253b4300ff3aac90f0b72854fbcbacb41aa5cf22e004d7fd11ba25b0c7991b2c13d7f4a63a2d9f839a0954617b04339bb9dbaee828a71

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44178.exe

Filesize
468KB

MD5
c496c416076c39d31c29b91fe73a0cdf

SHA1
bc0c7477d3ae9c73504e5f408960a63118127703

SHA256
8d35515c44f9289ddf249460f5ca76f01e227019c63ad458bc49d804f23dc516

SHA512
d813a1433244dff7378d8de42e6fc8e8669b15b0c1875f91e51b4741344cfcfdcb34f2bc48f3a68b9794be63bee43eabfc7c3c4c90dce7379718b1d098cd9c9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45058.exe

Filesize
468KB

MD5
ddfc48d9c490ad4233d37c03f4cdfd3f

SHA1
64991b540374534fcfad8bc6c55a0c4d58fe9e12

SHA256
a8185d3491a83f1baae43922148996b03f6127cdddd42e6d5116b7539333dec7

SHA512
c9e3d3618f596562b95009742f09e69a65926e6ea0084f4b0c8579efb3aa42957d730a86ea00ec6bf039edec49268b2ba9d8edaf867b05f853d02916353953ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47370.exe

Filesize
468KB

MD5
1766e52c7ed84f28fc57f61c092fcbbb

SHA1
cc81f5f478b26cbaa2096a558762e6cf37a13531

SHA256
6a5f2659dcb355a3f50bae6ed5e3e2d63edf2349edc7962bba0cd64fd4368abc

SHA512
df341920a68da45b786b63a1987c7ad3c32658b33c2f268e11e466d69115c5ec9af672562398f914b9f5ca8435b7b1ef9a54663ff527406151ae82ac9ef5fe55

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48779.exe

Filesize
468KB

MD5
e330434a718718091c95506ea6678a8f

SHA1
054a4c0227a5e1b99ec0b14f4028e8c9659104fb

SHA256
86320292a6836f2aa9ad54fa7521a9319afd9e4fd728380fc581fc29b9664740

SHA512
161bb8435635022dc9b430a2ab94c5028f309a0f8eb02cf6b1a6b5ca2938c71a45b9f9b645422a2c8a05fb2bce366b5a88aa54d501ebd7e78996f13849642d59

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49754.exe

Filesize
468KB

MD5
f2cd3eb970db420633539fccabf96cb2

SHA1
49707afb91dce9abd1da6e8a43f12d3eb76373a5

SHA256
a3b458f6a18488c0c0eaaa5121b82305026a4373150e8e20f2d3efa1461690a7

SHA512
d534f32182163bb9ff9ab2c1e654686c0f66178e69407fe32f6141974211f0e8201233b9b2195e000d5f88b16548b313833ced9a5d0b7d06e537cd524090c24a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52458.exe

Filesize
468KB

MD5
118429ef8a6e75ac89a9e895d728246e

SHA1
90c01ecdea556f046fd3440473158247c5b986b4

SHA256
ed2c15618dd72a8fdd52c418177d4137ca57e9bbbcee878bbbd02b0d917db6f6

SHA512
c1c770d720c6ada89dcedf3da60b19b6ce5d5ff29e4d834bbd46057cb65a8996f4a84040650c5c10149fbeb14923e1b82db78b1090efdaacf960d9c0918681e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55330.exe

Filesize
468KB

MD5
f4cff92f199181402a7900e86a373777

SHA1
d050c26b8ecb508fdf50bd9fda25dde7b3aec314

SHA256
9e394efcabc09ec394d1804d96a081aecad294a9718fd40559858d759771c055

SHA512
49f97c1cc237fc6f6b66b52b305d5a80d4b89135f054f278b708752d66689cafb606e1fab9092c372076582399bcc5218fc4e0046807ca35795cc2ecc175e119

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55722.exe

Filesize
468KB

MD5
ca76ed756c07c2b2e0ad4507036cce65

SHA1
3f8950c6540f2affdfa8380bbea071e0333c0ff2

SHA256
52a8142257b594582c7248a34cdbcf44a2680152576d1afccb94efcc7eba2b6a

SHA512
5e61fad09e753bf2e5af5f430f0987a49d38f6d11ea94b0b5826a9a5645340b896671294c7ff7a6e3f0e72584c758e863c13cce505c8db03c2b97ff15be53cdb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59067.exe

Filesize
468KB

MD5
fe0f3300c1acb26e5b5f22e38db51740

SHA1
d1e7dcad2e0e6b195c471f9ae4f1784e7d4da3e9

SHA256
7e8de226794ba52534fb981f050a4755c401bd2ad5fc5d6f50fd980f395a6cc3

SHA512
f45840819e83580690e06db039e495ebbe6dbf226f7a616c2591f4ddc1ec30cb025482c29f50fdddd26edd1d07b02f492aaede50f585b756cf8fdabf308cf751

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59259.exe

Filesize
468KB

MD5
c05766d5d15bc460780efa9308bd74f8

SHA1
40585f68f98eb4337dd2b325d5c06470d3726e51

SHA256
a37c68d42131a56beb9358ef856f5eca642919dd979529edf384c38f53b3fa04

SHA512
c45f3e1c9bc338064f3b19a7a1d7b74290149b34d562424a14cf0c0e1a9eb05863acc77440dd4ce8186e9e2a6a4b6760afdcaa31631e447fe790bee77ad3fc43

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62323.exe

Filesize
468KB

MD5
b0b30940bbc8f7e77796cb557fd5f82e

SHA1
2f88e04236d97a70c891f103bbf989a67befc7cf

SHA256
119fd31f1f77239d2114ae5b506f7934fec03b75173cdb1e7f3b9337c0cf4fe5

SHA512
cfc5e8e192a6cf4cdd9abd31f46328bc592d27f35d7c28cac8d53703c40cc86f93b267454e7b914abf42ddb4d0e755bec35542b4c99426d8060df75d22cf5cd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6786.exe

Filesize
468KB

MD5
3f7d65ee0fc2876affc226841ca278e7

SHA1
ad9496155dd43e42e31878b7809294f89cdd8470

SHA256
47c1b5f8031215a85d06a5541a0f97a817148f3161c943e03b88d9bc2f6094e0

SHA512
a955c6d129749d8072c3a728cf45cae5f01e3589f3fe9218506df3e342c3c8919c2deb246490468bc21692d973f3d77e77d493320a83fb2637e6a77e93be0f56

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8144.exe

Filesize
468KB

MD5
0d9af97bff36c0bfb12734e342cce67f

SHA1
95f7ecb2e03c2ac370082f1cf91d699e3509fa79

SHA256
06096976db785e5933ce61c3a52f368237abb07c95a7991c859a3ae5701b64f8

SHA512
d333f3c0222d3a70ed539cb0c06584ab72f0e49bbf0bb291d53e5254bc4bd7bab6daea494c528f6d3d35c294c4e160a13c1829f66e2212baac46c001e3116583

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-936.exe

Filesize
468KB

MD5
8e76980f05389151fde09fe4de9caff9

SHA1
e341481a46badadab7200f209cb2b2a161b9c684

SHA256
32d405c0bd4ac95faa458e3538b1ed8a771b2b2940fc4e0472eedfdf9ee9b090

SHA512
1b18eae0d5feade06b2fd5ef2e69f5cbf2f2fae63389366f3630379780354f9f7fb432cf98970075bebe3d839776801096dfdac818a310e719ec7540be86f3e9

Download Submit
memory/212-244-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/388-237-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/400-361-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/432-38-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/620-85-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/644-304-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/740-245-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/796-277-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/848-312-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/876-66-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/968-351-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1016-267-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1044-84-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1068-259-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1084-151-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1144-422-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1156-497-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1200-379-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1324-110-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1332-307-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1336-309-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1424-124-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1468-386-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1500-18-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1504-60-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1572-173-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1604-467-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1768-352-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1924-83-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2000-392-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2184-423-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2200-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2268-380-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2300-53-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2404-227-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2436-37-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2492-451-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2532-506-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2628-476-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2784-102-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2900-272-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2916-384-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3016-387-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3040-150-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3092-310-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3104-498-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3124-89-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3132-116-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3152-305-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3236-177-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3308-174-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3384-468-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3524-491-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3528-436-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3560-178-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3580-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3668-175-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3676-176-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3700-232-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3724-319-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3796-466-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3804-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3896-424-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4028-425-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4232-381-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4320-445-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4348-215-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4352-156-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4368-205-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4372-427-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4376-433-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4380-311-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4396-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4552-261-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4560-292-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4564-134-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4584-426-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4664-285-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4716-218-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4720-435-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4844-348-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4848-252-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4864-353-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4940-393-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4988-354-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5036-214-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5108-46-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5116-469-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5180-510-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5316-1104-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5324-1105-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5372-1106-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5388-1107-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5408-1108-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5436-1109-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5452-1110-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/13660-2874-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14952-3100-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads