d0a45f07cfa403fe94bff0e9d7bf0430d3d7056fff0546c0e23ae33f111931c4

Analysis

max time kernel
118s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
24/07/2024, 04:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

48dc67c362def3b69bc4e075ec6dd1e0N.exe
Size

468KB
MD5

48dc67c362def3b69bc4e075ec6dd1e0
SHA1

62260dd190379330371c2258d2bc7557a540d3d2
SHA256

d0a45f07cfa403fe94bff0e9d7bf0430d3d7056fff0546c0e23ae33f111931c4
SHA512

8507a0f0f46be860b07aa5d636fde49d637d6dc3730cab491483e5e7cbab4f1c87edd0fc5d946f7afc49d3b240def26cf818facc27e7a26afa9d30b1975b1e32
SSDEEP

3072:VFmnogBRjf8U2bYRPx3yqf8/fCbByIplPmHBQT30sCb+xlZNZglJ:VFWoikU2qPZyqfe0sxsC6/ZNZ

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4804	Unicorn-24389.exe
4784	Unicorn-54290.exe
5112	Unicorn-683.exe
4420	Unicorn-39877.exe
5040	Unicorn-6628.exe
4932	Unicorn-52300.exe
4656	Unicorn-17026.exe
3080	Unicorn-27314.exe
3656	Unicorn-55004.exe
1092	Unicorn-43733.exe
4216	Unicorn-60261.exe
3032	Unicorn-59612.exe
2696	Unicorn-40011.exe
2884	Unicorn-53747.exe
2612	Unicorn-38741.exe
1476	Unicorn-36472.exe
4304	Unicorn-13489.exe
4728	Unicorn-23311.exe
1704	Unicorn-26104.exe
3156	Unicorn-14916.exe
2376	Unicorn-15409.exe
1124	Unicorn-31746.exe
1200	Unicorn-31746.exe
2784	Unicorn-28408.exe
1332	Unicorn-42144.exe
4556	Unicorn-14267.exe
4944	Unicorn-58176.exe
4332	Unicorn-60578.exe
4924	Unicorn-26837.exe
1308	Unicorn-44050.exe
3880	Unicorn-37920.exe
3244	Unicorn-6203.exe
3232	Unicorn-24184.exe
4132	Unicorn-10801.exe
3504	Unicorn-10801.exe
3012	Unicorn-52995.exe
3696	Unicorn-16203.exe
5072	Unicorn-45721.exe
4748	Unicorn-26783.exe
3896	Unicorn-22146.exe
1672	Unicorn-50604.exe
3668	Unicorn-43093.exe
4368	Unicorn-27826.exe
1564	Unicorn-10913.exe
5028	Unicorn-27442.exe
1544	Unicorn-39371.exe
3308	Unicorn-26565.exe
1540	Unicorn-16859.exe
1020	Unicorn-23528.exe
2872	Unicorn-59922.exe
116	Unicorn-22075.exe
1388	Unicorn-43394.exe
4448	Unicorn-43129.exe
416	Unicorn-20543.exe
1160	Unicorn-17743.exe
4476	Unicorn-62693.exe
4920	Unicorn-63762.exe
3932	Unicorn-9880.exe
3992	Unicorn-11691.exe
4824	Unicorn-31282.exe
672	Unicorn-4001.exe
1148	Unicorn-52444.exe
748	Unicorn-52325.exe
4892	Unicorn-51676.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
9036	6108	WerFault.exe	215

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63157.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16856.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22484.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14741.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29313.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10325.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35893.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47074.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55190.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20609.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25020.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37896.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42044.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62815.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59189.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55995.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46843.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32935.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25857.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12413.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23986.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46621.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18949.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11691.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41179.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38578.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7718.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6628.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51945.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57693.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14609.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46149.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12900.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39794.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3597.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6565.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6459.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54142.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23252.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46843.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22500.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57701.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10872.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45721.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46242.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62452.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46838.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25596.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52725.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25563.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4074.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8221.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14539.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63355.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47092.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25980.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51945.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10541.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65282.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39739.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20474.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6739.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54147.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27442.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	5180	dwm.exe
Token: SeChangeNotifyPrivilege	5180	dwm.exe
Token: 33	5180	dwm.exe
Token: SeIncBasePriorityPrivilege	5180	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2424	48dc67c362def3b69bc4e075ec6dd1e0N.exe
4804	Unicorn-24389.exe
4784	Unicorn-54290.exe
5112	Unicorn-683.exe
4420	Unicorn-39877.exe
5040	Unicorn-6628.exe
4932	Unicorn-52300.exe
4656	Unicorn-17026.exe
3080	Unicorn-27314.exe
3656	Unicorn-55004.exe
1092	Unicorn-43733.exe
4216	Unicorn-60261.exe
2696	Unicorn-40011.exe
3032	Unicorn-59612.exe
2884	Unicorn-53747.exe
2612	Unicorn-38741.exe
1476	Unicorn-36472.exe
4304	Unicorn-13489.exe
1704	Unicorn-26104.exe
4728	Unicorn-23311.exe
3156	Unicorn-14916.exe
1124	Unicorn-31746.exe
1332	Unicorn-42144.exe
2376	Unicorn-15409.exe
4556	Unicorn-14267.exe
1200	Unicorn-31746.exe
4944	Unicorn-58176.exe
2784	Unicorn-28408.exe
4332	Unicorn-60578.exe
4924	Unicorn-26837.exe
1308	Unicorn-44050.exe
3244	Unicorn-6203.exe
3504	Unicorn-10801.exe
3012	Unicorn-52995.exe
3696	Unicorn-16203.exe
4132	Unicorn-10801.exe
3232	Unicorn-24184.exe
3880	Unicorn-37920.exe
4748	Unicorn-26783.exe
5072	Unicorn-45721.exe
3896	Unicorn-22146.exe
1672	Unicorn-50604.exe
3668	Unicorn-43093.exe
1564	Unicorn-10913.exe
4368	Unicorn-27826.exe
3308	Unicorn-26565.exe
1544	Unicorn-39371.exe
2872	Unicorn-59922.exe
416	Unicorn-20543.exe
5028	Unicorn-27442.exe
1388	Unicorn-43394.exe
116	Unicorn-22075.exe
4448	Unicorn-43129.exe
1020	Unicorn-23528.exe
1540	Unicorn-16859.exe
1160	Unicorn-17743.exe
4476	Unicorn-62693.exe
3932	Unicorn-9880.exe
4920	Unicorn-63762.exe
3992	Unicorn-11691.exe
4824	Unicorn-31282.exe
1148	Unicorn-52444.exe
748	Unicorn-52325.exe
672	Unicorn-4001.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 4804	2424	48dc67c362def3b69bc4e075ec6dd1e0N.exe	88
PID 2424 wrote to memory of 4804	2424	48dc67c362def3b69bc4e075ec6dd1e0N.exe	88
PID 2424 wrote to memory of 4804	2424	48dc67c362def3b69bc4e075ec6dd1e0N.exe	88
PID 4804 wrote to memory of 4784	4804	Unicorn-24389.exe	93
PID 4804 wrote to memory of 4784	4804	Unicorn-24389.exe	93
PID 4804 wrote to memory of 4784	4804	Unicorn-24389.exe	93
PID 2424 wrote to memory of 5112	2424	48dc67c362def3b69bc4e075ec6dd1e0N.exe	94
PID 2424 wrote to memory of 5112	2424	48dc67c362def3b69bc4e075ec6dd1e0N.exe	94
PID 2424 wrote to memory of 5112	2424	48dc67c362def3b69bc4e075ec6dd1e0N.exe	94
PID 4784 wrote to memory of 4420	4784	Unicorn-54290.exe	96
PID 4784 wrote to memory of 4420	4784	Unicorn-54290.exe	96
PID 4784 wrote to memory of 4420	4784	Unicorn-54290.exe	96
PID 5112 wrote to memory of 5040	5112	Unicorn-683.exe	97
PID 5112 wrote to memory of 5040	5112	Unicorn-683.exe	97
PID 5112 wrote to memory of 5040	5112	Unicorn-683.exe	97
PID 4804 wrote to memory of 4932	4804	Unicorn-24389.exe	98
PID 4804 wrote to memory of 4932	4804	Unicorn-24389.exe	98
PID 4804 wrote to memory of 4932	4804	Unicorn-24389.exe	98
PID 2424 wrote to memory of 4656	2424	48dc67c362def3b69bc4e075ec6dd1e0N.exe	99
PID 2424 wrote to memory of 4656	2424	48dc67c362def3b69bc4e075ec6dd1e0N.exe	99
PID 2424 wrote to memory of 4656	2424	48dc67c362def3b69bc4e075ec6dd1e0N.exe	99
PID 4420 wrote to memory of 3080	4420	Unicorn-39877.exe	102
PID 4420 wrote to memory of 3080	4420	Unicorn-39877.exe	102
PID 4420 wrote to memory of 3080	4420	Unicorn-39877.exe	102
PID 4784 wrote to memory of 3656	4784	Unicorn-54290.exe	103
PID 4784 wrote to memory of 3656	4784	Unicorn-54290.exe	103
PID 4784 wrote to memory of 3656	4784	Unicorn-54290.exe	103
PID 5040 wrote to memory of 1092	5040	Unicorn-6628.exe	104
PID 5040 wrote to memory of 1092	5040	Unicorn-6628.exe	104
PID 5040 wrote to memory of 1092	5040	Unicorn-6628.exe	104
PID 4932 wrote to memory of 4216	4932	Unicorn-52300.exe	105
PID 4932 wrote to memory of 4216	4932	Unicorn-52300.exe	105
PID 4932 wrote to memory of 4216	4932	Unicorn-52300.exe	105
PID 5112 wrote to memory of 2696	5112	Unicorn-683.exe	106
PID 5112 wrote to memory of 2696	5112	Unicorn-683.exe	106
PID 5112 wrote to memory of 2696	5112	Unicorn-683.exe	106
PID 2424 wrote to memory of 3032	2424	48dc67c362def3b69bc4e075ec6dd1e0N.exe	107
PID 2424 wrote to memory of 3032	2424	48dc67c362def3b69bc4e075ec6dd1e0N.exe	107
PID 2424 wrote to memory of 3032	2424	48dc67c362def3b69bc4e075ec6dd1e0N.exe	107
PID 4804 wrote to memory of 2884	4804	Unicorn-24389.exe	108
PID 4804 wrote to memory of 2884	4804	Unicorn-24389.exe	108
PID 4804 wrote to memory of 2884	4804	Unicorn-24389.exe	108
PID 3080 wrote to memory of 2612	3080	Unicorn-27314.exe	109
PID 3080 wrote to memory of 2612	3080	Unicorn-27314.exe	109
PID 3080 wrote to memory of 2612	3080	Unicorn-27314.exe	109
PID 4420 wrote to memory of 1476	4420	Unicorn-39877.exe	110
PID 4420 wrote to memory of 1476	4420	Unicorn-39877.exe	110
PID 4420 wrote to memory of 1476	4420	Unicorn-39877.exe	110
PID 3656 wrote to memory of 4304	3656	Unicorn-55004.exe	111
PID 3656 wrote to memory of 4304	3656	Unicorn-55004.exe	111
PID 3656 wrote to memory of 4304	3656	Unicorn-55004.exe	111
PID 4784 wrote to memory of 4728	4784	Unicorn-54290.exe	112
PID 4784 wrote to memory of 4728	4784	Unicorn-54290.exe	112
PID 4784 wrote to memory of 4728	4784	Unicorn-54290.exe	112
PID 4656 wrote to memory of 1704	4656	Unicorn-17026.exe	113
PID 4656 wrote to memory of 1704	4656	Unicorn-17026.exe	113
PID 4656 wrote to memory of 1704	4656	Unicorn-17026.exe	113
PID 1092 wrote to memory of 3156	1092	Unicorn-43733.exe	114
PID 1092 wrote to memory of 3156	1092	Unicorn-43733.exe	114
PID 1092 wrote to memory of 3156	1092	Unicorn-43733.exe	114
PID 3032 wrote to memory of 2376	3032	Unicorn-59612.exe	115
PID 3032 wrote to memory of 2376	3032	Unicorn-59612.exe	115
PID 3032 wrote to memory of 2376	3032	Unicorn-59612.exe	115
PID 2696 wrote to memory of 1200	2696	Unicorn-40011.exe	116

C:\Users\Admin\AppData\Local\Temp\48dc67c362def3b69bc4e075ec6dd1e0N.exe
"C:\Users\Admin\AppData\Local\Temp\48dc67c362def3b69bc4e075ec6dd1e0N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24389.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24389.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54290.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54290.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39877.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39877.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27314.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38741.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60578.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63762.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58402.exe
        9⤵
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18450.exe
        10⤵
        
        PID:5208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19204.exe
        11⤵
        
        PID:11088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28973.exe
        11⤵
        
        PID:14444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57721.exe
        10⤵
        
        PID:9208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5217.exe
        10⤵
        
        PID:13104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14850.exe
        10⤵
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39899.exe
        9⤵
        
        PID:6544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61419.exe
        10⤵
        
        PID:10176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2340.exe
        10⤵
        
        PID:12840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52621.exe
        10⤵
        
        PID:16784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54160.exe
        9⤵
        
        PID:9500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1181.exe
        9⤵
        
        PID:12488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6076.exe
        9⤵
        
        PID:16880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49689.exe
        8⤵
        
        PID:644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39781.exe
        9⤵
        
        PID:7500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49028.exe
        10⤵
        
        PID:14176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28581.exe
        10⤵
        
        PID:7364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22970.exe
        9⤵
        
        PID:9852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-145.exe
        9⤵
        
        PID:13308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54825.exe
        8⤵
        
        PID:8316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30081.exe
        8⤵
        
        PID:11776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19533.exe
        8⤵
        
        PID:13564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4027.exe
        8⤵
        
        PID:17852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9880.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43410.exe
        8⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-769.exe
        9⤵
        
        PID:7088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12900.exe
        10⤵
        
        PID:8900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46843.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:13876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5884.exe
        10⤵
        
        PID:18328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6107.exe
        9⤵
        
        PID:9084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20593.exe
        9⤵
        
        PID:12800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12162.exe
        9⤵
        
        PID:6756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40200.exe
        8⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51925.exe
        9⤵
        
        PID:9868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60107.exe
        9⤵
        
        PID:13948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55773.exe
        9⤵
        
        PID:7248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54160.exe
        8⤵
        
        PID:9336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11082.exe
        8⤵
        
        PID:13092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19749.exe
        8⤵
        
        PID:18324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49200.exe
        7⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12900.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12618.exe
        8⤵
        
        PID:12012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62790.exe
        8⤵
        
        PID:7068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42220.exe
        7⤵
        
        PID:6904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9110.exe
        8⤵
        
        PID:9224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53390.exe
        8⤵
        
        PID:15128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25857.exe
        7⤵
        
        PID:11440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63685.exe
        7⤵
        
        PID:5656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24184.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57701.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52725.exe
        8⤵
        
        PID:6100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46242.exe
        9⤵
        
        PID:3588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22500.exe
        9⤵
        
        PID:14128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58172.exe
        8⤵
        
        PID:7916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5965.exe
        8⤵
        
        PID:14088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15284.exe
        8⤵
        
        PID:16432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59196.exe
        7⤵
        
        PID:6284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1665.exe
        8⤵
        
        PID:8148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2333.exe
        8⤵
        
        PID:12672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41021.exe
        8⤵
        
        PID:16352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6677.exe
        8⤵
        
        PID:17916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49344.exe
        7⤵
        
        PID:8256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3962.exe
        7⤵
        
        PID:11628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37905.exe
        7⤵
        
        PID:4256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55078.exe
        7⤵
        
        PID:16808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2386.exe
        6⤵
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53426.exe
        7⤵
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-70.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-70.exe
        8⤵
        
        PID:10576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54142.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7340.exe
        8⤵
        
        PID:16412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40808.exe
        7⤵
        
        PID:9240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5217.exe
        7⤵
        
        PID:13084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29542.exe
        7⤵
        
        PID:5184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19915.exe
        6⤵
        
        PID:6804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63220.exe
        7⤵
        
        PID:11016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55995.exe
        7⤵
        
        PID:13416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14540.exe
        7⤵
        
        PID:3144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27076.exe
        6⤵
        
        PID:9248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54507.exe
        6⤵
        
        PID:13976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38703.exe
        6⤵
        
        PID:16544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36472.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26837.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62693.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12465.exe
        8⤵
        
        PID:536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46242.exe
        9⤵
        
        PID:7856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22500.exe
        9⤵
        
        PID:14076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20626.exe
        9⤵
        
        PID:18376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14539.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29540.exe
        9⤵
        
        PID:13716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10709.exe
        9⤵
        
        PID:5400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39794.exe
        8⤵
        
        PID:10628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42347.exe
        8⤵
        
        PID:3516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5500.exe
        8⤵
        
        PID:13488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42776.exe
        7⤵
        
        PID:2364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49330.exe
        8⤵
        
        PID:7512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2333.exe
        8⤵
        
        PID:12468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11477.exe
        8⤵
        
        PID:6628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45779.exe
        7⤵
        
        PID:1580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38747.exe
        7⤵
        
        PID:11748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20609.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5877.exe
        7⤵
        
        PID:17740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11691.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7748.exe
        7⤵
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45074.exe
        8⤵
        
        PID:7008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19829.exe
        9⤵
        
        PID:9964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49922.exe
        9⤵
        
        PID:12364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14933.exe
        9⤵
        
        PID:17324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59477.exe
        8⤵
        
        PID:10548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7437.exe
        8⤵
        
        PID:13768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22136.exe
        7⤵
        
        PID:7728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13310.exe
        8⤵
        
        PID:17360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45253.exe
        7⤵
        
        PID:10776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16202.exe
        7⤵
        
        PID:14620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50662.exe
        7⤵
        
        PID:5148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46512.exe
        6⤵
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62770.exe
        7⤵
        
        PID:7884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22500.exe
        7⤵
        
        PID:14096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47013.exe
        7⤵
        
        PID:17908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26377.exe
        6⤵
        
        PID:7328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61062.exe
        7⤵
        
        PID:17144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25857.exe
        6⤵
        
        PID:11376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38751.exe
        6⤵
        
        PID:16320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42548.exe
        6⤵
        
        PID:17812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37920.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38402.exe
        6⤵
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4017.exe
        7⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46242.exe
        8⤵
        
        PID:3448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34532.exe
        9⤵
        
        PID:14708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43573.exe
        9⤵
        
        PID:16684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14922.exe
        8⤵
        
        PID:11460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6776.exe
        7⤵
        
        PID:3736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13310.exe
        8⤵
        
        PID:7756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41909.exe
        7⤵
        
        PID:10588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35893.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:18088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8651.exe
        6⤵
        
        PID:6184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65282.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46843.exe
        7⤵
        
        PID:13900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55116.exe
        6⤵
        
        PID:8676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29028.exe
        6⤵
        
        PID:12628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21685.exe
        6⤵
        
        PID:16300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64079.exe
        6⤵
        
        PID:17888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23721.exe
        5⤵
        
        PID:3940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21339.exe
        6⤵
        
        PID:6944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51541.exe
        7⤵
        
        PID:10124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60107.exe
        7⤵
        
        PID:13956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39437.exe
        7⤵
        
        PID:17216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10226.exe
        6⤵
        
        PID:8020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21933.exe
        6⤵
        
        PID:12440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2613.exe
        6⤵
        
        PID:6072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51024.exe
        5⤵
        
        PID:7028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21282.exe
        6⤵
        
        PID:10200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9261.exe
        6⤵
        
        PID:14192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25212.exe
        6⤵
        
        PID:16700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34056.exe
        5⤵
        
        PID:8844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18323.exe
        5⤵
        
        PID:12832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16980.exe
        5⤵
        
        PID:1928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55004.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55004.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13489.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44050.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55781.exe
        7⤵
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52725.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12900.exe
        9⤵
        
        PID:8912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46843.exe
        9⤵
        
        PID:13892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4540.exe
        9⤵
        
        PID:17724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6776.exe
        8⤵
        
        PID:7308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43319.exe
        9⤵
        
        PID:10708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-442.exe
        9⤵
        
        PID:14936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10325.exe
        9⤵
        
        PID:16408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64507.exe
        8⤵
        
        PID:11972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55462.exe
        8⤵
        
        PID:17200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60265.exe
        7⤵
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61909.exe
        8⤵
        
        PID:8868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11549.exe
        8⤵
        
        PID:12032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20405.exe
        8⤵
        
        PID:16368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49344.exe
        7⤵
        
        PID:8248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23252.exe
        7⤵
        
        PID:12316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45135.exe
        7⤵
        
        PID:6056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61100.exe
        6⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2004.exe
        7⤵
        
        PID:6432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-70.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-70.exe
        8⤵
        
        PID:10736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4577.exe
        8⤵
        
        PID:15260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29313.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19533.exe
        7⤵
        
        PID:13468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39663.exe
        7⤵
        
        PID:17292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31647.exe
        6⤵
        
        PID:7180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13443.exe
        7⤵
        
        PID:10296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11477.exe
        7⤵
        
        PID:6584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20474.exe
        6⤵
        
        PID:9416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4052.exe
        6⤵
        
        PID:14164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6203.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23493.exe
        6⤵
        
        PID:4312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8916.exe
        7⤵
        
        PID:6920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31517.exe
        8⤵
        
        PID:10824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2340.exe
        8⤵
        
        PID:13440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47030.exe
        8⤵
        
        PID:17384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13403.exe
        7⤵
        
        PID:7528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16068.exe
        7⤵
        
        PID:12420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2812.exe
        7⤵
        
        PID:5636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6459.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56149.exe
        7⤵
        
        PID:6560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13310.exe
        8⤵
        
        PID:16612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6858.exe
        7⤵
        
        PID:12824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24252.exe
        7⤵
        
        PID:6516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54160.exe
        6⤵
        
        PID:9328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58638.exe
        6⤵
        
        PID:13220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22604.exe
        6⤵
        
        PID:17336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45344.exe
        5⤵
        
        PID:5492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19685.exe
        6⤵
        
        PID:6320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24738.exe
        7⤵
        
        PID:8624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22618.exe
        7⤵
        
        PID:12948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6681.exe
        7⤵
        
        PID:6864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15652.exe
        6⤵
        
        PID:10020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17537.exe
        6⤵
        
        PID:15272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55955.exe
        6⤵
        
        PID:15588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20984.exe
        5⤵
        
        PID:6928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32935.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54142.exe
        6⤵
        
        PID:13532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9068.exe
        6⤵
        
        PID:17240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27076.exe
        5⤵
        
        PID:9904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46621.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62815.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23311.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23311.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10801.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52325.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63301.exe
        7⤵
        
        PID:6248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46242.exe
        8⤵
        
        PID:7980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22500.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3950.exe
        8⤵
        
        PID:7700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51945.exe
        7⤵
        
        PID:8196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32987.exe
        7⤵
        
        PID:12344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60742.exe
        7⤵
        
        PID:15628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5695.exe
        6⤵
        
        PID:7120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30180.exe
        7⤵
        
        PID:11996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56925.exe
        7⤵
        
        PID:6488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56677.exe
        6⤵
        
        PID:10536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18067.exe
        6⤵
        
        PID:15304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17748.exe
        6⤵
        
        PID:18348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51676.exe
        5⤵
        Executes dropped EXE
        
        PID:4892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57909.exe
        6⤵
        
        PID:3620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9521.exe
        7⤵
        
        PID:7628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13443.exe
        8⤵
        
        PID:10456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22746.exe
        8⤵
        
        PID:12024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9753.exe
        8⤵
        
        PID:16892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14989.exe
        7⤵
        
        PID:10952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1572.exe
        7⤵
        
        PID:732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47414.exe
        7⤵
        
        PID:18264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14923.exe
        6⤵
        
        PID:8152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44342.exe
        7⤵
        
        PID:12404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63355.exe
        6⤵
        
        PID:11568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18757.exe
        6⤵
        
        PID:5852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16226.exe
        5⤵
        
        PID:1016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46242.exe
        6⤵
        
        PID:7764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22500.exe
        6⤵
        
        PID:14112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61244.exe
        5⤵
        
        PID:6208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63439.exe
        6⤵
        
        PID:16648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25857.exe
        5⤵
        
        PID:11432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47348.exe
        5⤵
        
        PID:4988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16203.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16203.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4001.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45797.exe
        6⤵
        
        PID:5368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15588.exe
        7⤵
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2333.exe
        7⤵
        
        PID:12428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41021.exe
        7⤵
        
        PID:16360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52621.exe
        7⤵
        
        PID:17704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53948.exe
        6⤵
        
        PID:6684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39794.exe
        6⤵
        
        PID:8628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42347.exe
        6⤵
        
        PID:5808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22220.exe
        6⤵
        
        PID:17064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43051.exe
        5⤵
        
        PID:6356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46149.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9629.exe
        6⤵
        
        PID:11636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5413.exe
        6⤵
        
        PID:5512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49344.exe
        5⤵
        
        PID:8284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30767.exe
        6⤵
        
        PID:17364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23252.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14458.exe
        5⤵
        
        PID:15772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22942.exe
        5⤵
        
        PID:17732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13519.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13519.exe
      4⤵
      PID:3148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27650.exe
        5⤵
        
        PID:5384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46242.exe
        6⤵
        
        PID:3760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13310.exe
        7⤵
        
        PID:17392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58642.exe
        6⤵
        
        PID:11772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6268.exe
        6⤵
        
        PID:17264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53948.exe
        5⤵
        
        PID:5276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39794.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51814.exe
        5⤵
        
        PID:5796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54665.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54665.exe
      4⤵
      PID:6304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15588.exe
        5⤵
        
        PID:6724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2333.exe
        5⤵
        
        PID:12656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41021.exe
        5⤵
        
        PID:16344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12085.exe
        5⤵
        
        PID:18212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47074.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47074.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39833.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39833.exe
      4⤵
      PID:11620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11570.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11570.exe
      4⤵
      PID:4604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49477.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49477.exe
      4⤵
      PID:16572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52300.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52300.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60261.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60261.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31746.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43093.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32725.exe
        7⤵
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37896.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6739.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:12592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27285.exe
        9⤵
        
        PID:16328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-812.exe
        9⤵
        
        PID:17824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26804.exe
        8⤵
        
        PID:10660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8205.exe
        8⤵
        
        PID:13636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38557.exe
        8⤵
        
        PID:17104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5608.exe
        7⤵
        
        PID:7672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60183.exe
        8⤵
        
        PID:14964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6220.exe
        8⤵
        
        PID:8384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26804.exe
        7⤵
        
        PID:10796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17537.exe
        7⤵
        
        PID:15292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32859.exe
        6⤵
        
        PID:5312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48946.exe
        7⤵
        
        PID:9056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61627.exe
        7⤵
        
        PID:10440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27814.exe
        7⤵
        
        PID:5984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36355.exe
        6⤵
        
        PID:6892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39796.exe
        7⤵
        
        PID:12512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6297.exe
        7⤵
        
        PID:6520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6641.exe
        6⤵
        
        PID:1936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46196.exe
        6⤵
        
        PID:15384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39371.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49637.exe
        6⤵
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28629.exe
        7⤵
        
        PID:6448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63127.exe
        8⤵
        
        PID:11560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34282.exe
        8⤵
        
        PID:15472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10325.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13841.exe
        7⤵
        
        PID:10972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41179.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36636.exe
        7⤵
        
        PID:17756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55193.exe
        6⤵
        
        PID:7616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26708.exe
        7⤵
        
        PID:9396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46955.exe
        7⤵
        
        PID:14852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57309.exe
        7⤵
        
        PID:16588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26804.exe
        6⤵
        
        PID:10684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5838.exe
        6⤵
        
        PID:6856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36979.exe
        5⤵
        
        PID:5328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33253.exe
        6⤵
        
        PID:8088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57963.exe
        6⤵
        
        PID:10572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63378.exe
        6⤵
        
        PID:14968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41753.exe
        5⤵
        
        PID:7036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6147.exe
        6⤵
        
        PID:12092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10325.exe
        6⤵
        
        PID:7220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36993.exe
        5⤵
        
        PID:10236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17146.exe
        5⤵
        
        PID:1196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6798.exe
        5⤵
        
        PID:17276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28408.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28408.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26565.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65013.exe
        6⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3841.exe
        7⤵
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47092.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38093.exe
        8⤵
        
        PID:6500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40808.exe
        7⤵
        
        PID:9276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5217.exe
        7⤵
        
        PID:13112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13781.exe
        7⤵
        
        PID:6512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51753.exe
        6⤵
        
        PID:5020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25857.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14484.exe
        6⤵
        
        PID:5508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4411.exe
        5⤵
        
        PID:5896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33637.exe
        6⤵
        
        PID:8072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14419.exe
        7⤵
        
        PID:12276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48282.exe
        7⤵
        
        PID:5924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38746.exe
        6⤵
        
        PID:11220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19169.exe
        6⤵
        
        PID:3464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9359.exe
        5⤵
        
        PID:7784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63823.exe
        6⤵
        
        PID:17116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32670.exe
        5⤵
        
        PID:10668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65077.exe
        5⤵
        
        PID:13472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5685.exe
        5⤵
        
        PID:17076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20543.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20543.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-244.exe
        5⤵
        
        PID:5772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19301.exe
        6⤵
        
        PID:4900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54914.exe
        7⤵
        
        PID:10032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49922.exe
        7⤵
        
        PID:11612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61638.exe
        7⤵
        
        PID:17396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40808.exe
        6⤵
        
        PID:9440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26753.exe
        6⤵
        
        PID:13248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15125.exe
        6⤵
        
        PID:17228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17912.exe
        5⤵
        
        PID:7284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63220.exe
        6⤵
        
        PID:11084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55995.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25788.exe
        6⤵
        
        PID:7320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51781.exe
        5⤵
        
        PID:9808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6010.exe
        5⤵
        
        PID:13300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6460.exe
        5⤵
        
        PID:17132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52460.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52460.exe
      4⤵
      PID:6132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-129.exe
        5⤵
        
        PID:7280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2333.exe
        5⤵
        
        PID:12452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11477.exe
        5⤵
        
        PID:6524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16642.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16642.exe
      4⤵
      PID:7200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13310.exe
        5⤵
        
        PID:16596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9322.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9322.exe
      4⤵
      PID:11412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34212.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34212.exe
      4⤵
      PID:14036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26285.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26285.exe
      4⤵
      PID:8356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53747.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53747.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45721.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45721.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:5072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23986.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31506.exe
        6⤵
        
        PID:6336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15588.exe
        7⤵
        
        PID:3340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2333.exe
        7⤵
        
        PID:12664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41021.exe
        7⤵
        
        PID:16336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3420.exe
        7⤵
        
        PID:8308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51945.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22484.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12277.exe
        7⤵
        
        PID:17992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56443.exe
        6⤵
        
        PID:12396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51814.exe
        6⤵
        
        PID:6020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5695.exe
        5⤵
        
        PID:1456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34138.exe
        6⤵
        
        PID:11528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40706.exe
        6⤵
        
        PID:15108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45302.exe
        6⤵
        
        PID:17160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56677.exe
        5⤵
        
        PID:10528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47773.exe
        5⤵
        
        PID:13800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39279.exe
        5⤵
        
        PID:16944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10175.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10175.exe
      4⤵
      PID:5376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3841.exe
        5⤵
        
        PID:6472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19146.exe
        6⤵
        
        PID:11784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38869.exe
        6⤵
        
        PID:13996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5605.exe
        6⤵
        
        PID:5524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40808.exe
        5⤵
        
        PID:9268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5217.exe
        5⤵
        
        PID:13120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9247.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9247.exe
      4⤵
      PID:8032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26986.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26986.exe
      4⤵
      PID:10812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-70.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-70.exe
      4⤵
      PID:13428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42621.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42621.exe
      4⤵
      PID:7592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14267.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14267.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43394.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43394.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2932.exe
        5⤵
        
        PID:5724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19301.exe
        6⤵
        
        PID:6236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40631.exe
        7⤵
        
        PID:10220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28973.exe
        7⤵
        
        PID:14452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40973.exe
        7⤵
        
        PID:16624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40808.exe
        6⤵
        
        PID:9408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26068.exe
        6⤵
        
        PID:13232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46838.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51753.exe
        5⤵
        
        PID:6912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25857.exe
        5⤵
        
        PID:11420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63685.exe
        5⤵
        
        PID:5676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32859.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32859.exe
      4⤵
      PID:5332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61893.exe
        5⤵
        
        PID:1980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50574.exe
        5⤵
        
        PID:10556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40112.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40112.exe
      4⤵
      PID:7964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6641.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6641.exe
      4⤵
      PID:11304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17743.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17743.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59170.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59170.exe
      4⤵
      PID:6092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45074.exe
        5⤵
        
        PID:6956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53703.exe
        6⤵
        
        PID:12232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8221.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41357.exe
        6⤵
        
        PID:17772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50508.exe
        5⤵
        
        PID:10100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32513.exe
        5⤵
        
        PID:12556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14741.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52307.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52307.exe
      4⤵
      PID:7340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34523.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34523.exe
      4⤵
      PID:11388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33681.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33681.exe
      4⤵
      PID:13492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14488.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14488.exe
    3⤵
    PID:5240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12900.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12900.exe
      4⤵
      PID:8960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60942.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60942.exe
      4⤵
      PID:12240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11477.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11477.exe
      4⤵
      PID:6576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10260.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10260.exe
    3⤵
    PID:8096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8870.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8870.exe
      4⤵
      PID:14416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27813.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27813.exe
      4⤵
      PID:17748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4857.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4857.exe
    3⤵
    PID:6108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7346.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7346.exe
    3⤵
    PID:14396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50354.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50354.exe
    3⤵
    PID:16960
- C:\Users\Admin\AppData\Local\Temp\Unicorn-683.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-683.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6628.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6628.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43733.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43733.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14916.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22146.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55781.exe
        7⤵
        
        PID:4552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44277.exe
        8⤵
        
        PID:6228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15588.exe
        9⤵
        
        PID:7976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2333.exe
        9⤵
        
        PID:12460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27814.exe
        9⤵
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51945.exe
        8⤵
        
        PID:8212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32881.exe
        8⤵
        
        PID:11800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44734.exe
        8⤵
        
        PID:15240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6953.exe
        8⤵
        
        PID:17008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5695.exe
        7⤵
        
        PID:7056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52068.exe
        8⤵
        
        PID:10936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39170.exe
        8⤵
        
        PID:3172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15618.exe
        8⤵
        
        PID:16992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4571.exe
        7⤵
        
        PID:10088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29713.exe
        7⤵
        
        PID:12640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22981.exe
        7⤵
        
        PID:7268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61977.exe
        6⤵
        
        PID:5392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63301.exe
        7⤵
        
        PID:6256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32117.exe
        8⤵
        
        PID:8028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2333.exe
        8⤵
        
        PID:12476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54147.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51945.exe
        7⤵
        
        PID:8236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16268.exe
        8⤵
        
        PID:17252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63634.exe
        7⤵
        
        PID:11676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46571.exe
        7⤵
        
        PID:15040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57430.exe
        7⤵
        
        PID:8420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43356.exe
        6⤵
        
        PID:6996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30180.exe
        7⤵
        
        PID:12072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40397.exe
        7⤵
        
        PID:6680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61443.exe
        6⤵
        
        PID:10064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13178.exe
        6⤵
        
        PID:12612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7182.exe
        6⤵
        
        PID:17376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50604.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22725.exe
        6⤵
        
        PID:5132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31506.exe
        7⤵
        
        PID:6376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29429.exe
        8⤵
        
        PID:9004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60386.exe
        8⤵
        
        PID:13208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28230.exe
        8⤵
        
        PID:18052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50876.exe
        7⤵
        
        PID:8160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63634.exe
        7⤵
        
        PID:11660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11740.exe
        7⤵
        
        PID:5732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5695.exe
        6⤵
        
        PID:7016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11414.exe
        7⤵
        
        PID:10408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32045.exe
        7⤵
        
        PID:14880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10325.exe
        7⤵
        
        PID:7228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56677.exe
        6⤵
        
        PID:10696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2307.exe
        6⤵
        
        PID:15312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57620.exe
        6⤵
        
        PID:15776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9298.exe
        5⤵
        
        PID:5432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22757.exe
        6⤵
        
        PID:6824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1139.exe
        7⤵
        
        PID:10748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39170.exe
        7⤵
        
        PID:808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13698.exe
        7⤵
        
        PID:3036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8712.exe
        6⤵
        
        PID:8588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22513.exe
        6⤵
        
        PID:11280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53883.exe
        6⤵
        
        PID:15456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47018.exe
        6⤵
        
        PID:6784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20488.exe
        5⤵
        
        PID:5216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62452.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11477.exe
        6⤵
        
        PID:6468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51744.exe
        5⤵
        
        PID:8780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33437.exe
        5⤵
        
        PID:13148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5454.exe
        5⤵
        
        PID:17172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26783.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26783.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55781.exe
        5⤵
        
        PID:4576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12289.exe
        6⤵
        
        PID:6476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3601.exe
        7⤵
        
        PID:9988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49922.exe
        7⤵
        
        PID:11384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52621.exe
        7⤵
        
        PID:16796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19848.exe
        6⤵
        
        PID:8448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49794.exe
        6⤵
        
        PID:10056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35819.exe
        6⤵
        
        PID:13812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19148.exe
        6⤵
        
        PID:5936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40088.exe
        5⤵
        
        PID:7020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20514.exe
        6⤵
        
        PID:9780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7341.exe
        6⤵
        
        PID:13856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10137.exe
        6⤵
        
        PID:17312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20365.exe
        5⤵
        
        PID:8144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36532.exe
        5⤵
        
        PID:13964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53151.exe
        5⤵
        
        PID:18192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15163.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15163.exe
      4⤵
      PID:5424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3841.exe
        5⤵
        
        PID:5688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53378.exe
        6⤵
        
        PID:9832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16090.exe
        6⤵
        
        PID:12508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40808.exe
        5⤵
        
        PID:8456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5217.exe
        5⤵
        
        PID:13128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46454.exe
        5⤵
        
        PID:6668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12319.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12319.exe
      4⤵
      PID:5880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42084.exe
        5⤵
        
        PID:11104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13310.exe
        6⤵
        
        PID:6800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5434.exe
        5⤵
        
        PID:14260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49901.exe
        5⤵
        
        PID:5972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10541.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10541.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4966.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4966.exe
      4⤵
      PID:14000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1412.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1412.exe
      4⤵
      PID:6816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40011.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40011.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31746.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31746.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59922.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16856.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53426.exe
        7⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16516.exe
        8⤵
        
        PID:10360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54142.exe
        8⤵
        
        PID:13652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8684.exe
        8⤵
        
        PID:17040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44123.exe
        7⤵
        
        PID:10772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60578.exe
        7⤵
        
        PID:14900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44213.exe
        7⤵
        
        PID:15468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50092.exe
        6⤵
        
        PID:6740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7718.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11477.exe
        7⤵
        
        PID:1836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29876.exe
        6⤵
        
        PID:8660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3597.exe
        6⤵
        
        PID:14312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52973.exe
        6⤵
        
        PID:16788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15563.exe
        5⤵
        
        PID:5068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40082.exe
        6⤵
        
        PID:7548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35540.exe
        7⤵
        
        PID:11052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28973.exe
        7⤵
        
        PID:14436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22218.exe
        6⤵
        
        PID:11116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42709.exe
        6⤵
        
        PID:14420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62406.exe
        6⤵
        
        PID:17764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21083.exe
        5⤵
        
        PID:8332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59189.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21370.exe
        5⤵
        
        PID:3248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39087.exe
        5⤵
        
        PID:17096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22075.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22075.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51858.exe
        5⤵
        
        PID:5820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19301.exe
        6⤵
        
        PID:6352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2065.exe
        7⤵
        
        PID:9696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41274.exe
        7⤵
        
        PID:13832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25404.exe
        7⤵
        
        PID:7412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24472.exe
        6⤵
        
        PID:9260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52773.exe
        6⤵
        
        PID:13168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29926.exe
        6⤵
        
        PID:14852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1384.exe
        5⤵
        
        PID:4936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36549.exe
        6⤵
        
        PID:8768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11098.exe
        6⤵
        
        PID:13824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25596.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:18276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29876.exe
        5⤵
        
        PID:9228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46843.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63549.exe
        5⤵
        
        PID:17796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29298.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29298.exe
      4⤵
      PID:5292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12900.exe
        5⤵
        
        PID:8928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46843.exe
        5⤵
        
        PID:13884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39133.exe
        5⤵
        
        PID:17300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59324.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59324.exe
      4⤵
      PID:4336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6566.exe
        5⤵
        
        PID:15796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12245.exe
        5⤵
        
        PID:7316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25857.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25857.exe
      4⤵
      PID:11368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47348.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47348.exe
      4⤵
      PID:5440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42144.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42144.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10913.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10913.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16306.exe
        5⤵
        
        PID:5404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3841.exe
        6⤵
        
        PID:6244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14211.exe
        7⤵
        
        PID:11036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55995.exe
        7⤵
        
        PID:15352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42317.exe
        7⤵
        
        PID:1224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29313.exe
        6⤵
        
        PID:12048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4074.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40047.exe
        6⤵
        
        PID:16536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51753.exe
        5⤵
        
        PID:7348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6566.exe
        6⤵
        
        PID:15748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60870.exe
        6⤵
        
        PID:17348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25857.exe
        5⤵
        
        PID:11292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63685.exe
        5⤵
        
        PID:13764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31992.exe
      4⤵
      PID:5800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3841.exe
        5⤵
        
        PID:6324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36274.exe
        6⤵
        
        PID:10012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17709.exe
        6⤵
        
        PID:12540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25020.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51803.exe
        5⤵
        
        PID:11152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16369.exe
        5⤵
        
        PID:13984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18949.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15119.exe
      4⤵
      PID:6876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6147.exe
        5⤵
        
        PID:12080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47213.exe
        5⤵
        
        PID:15624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35742.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35742.exe
      4⤵
      PID:9544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20580.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20580.exe
      4⤵
      PID:14044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22213.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22213.exe
      4⤵
      PID:16912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43129.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43129.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50706.exe
      4⤵
      PID:5608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19685.exe
        5⤵
        
        PID:5876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31818.exe
        6⤵
        
        PID:11068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42709.exe
        6⤵
        
        PID:14428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39739.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5217.exe
        5⤵
        
        PID:13136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13589.exe
        5⤵
        
        PID:5736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50092.exe
      4⤵
      PID:6848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63220.exe
        5⤵
        
        PID:10436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55995.exe
        5⤵
        
        PID:13296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57693.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29876.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29876.exe
      4⤵
      PID:8312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12717.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12717.exe
      4⤵
      PID:13988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36085.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36085.exe
      4⤵
      PID:3028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34178.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34178.exe
    3⤵
    PID:5200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62770.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62770.exe
      4⤵
      PID:7812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18778.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18778.exe
      4⤵
      PID:13284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52429.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52429.exe
      4⤵
      PID:18072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48347.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48347.exe
    3⤵
    PID:6192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6147.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6147.exe
      4⤵
      PID:12100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8221.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8221.exe
      4⤵
      PID:13488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12085.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12085.exe
      4⤵
      PID:16820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37524.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37524.exe
    3⤵
    PID:9032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12681.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12681.exe
    3⤵
    PID:13908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12413.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12413.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:16928
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17026.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17026.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26104.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26104.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10801.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10801.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38402.exe
        5⤵
        
        PID:968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52725.exe
        6⤵
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46242.exe
        7⤵
        
        PID:1084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27204.exe
        7⤵
        
        PID:2332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25992.exe
        6⤵
        
        PID:7936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2259.exe
        7⤵
        
        PID:15428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52614.exe
        7⤵
        
        PID:17844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28657.exe
        6⤵
        
        PID:11404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2613.exe
        6⤵
        
        PID:13480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10872.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46242.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22500.exe
        6⤵
        
        PID:14104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49344.exe
        5⤵
        
        PID:8268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38747.exe
        5⤵
        
        PID:11756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28069.exe
        5⤵
        
        PID:16380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2859.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2859.exe
      4⤵
      PID:1008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31506.exe
        5⤵
        
        PID:6264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46642.exe
        6⤵
        
        PID:9076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61627.exe
        6⤵
        
        PID:10344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22902.exe
        6⤵
        
        PID:15252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51945.exe
        5⤵
        
        PID:8228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63634.exe
        5⤵
        
        PID:11664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44605.exe
        5⤵
        
        PID:15300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53824.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53824.exe
      4⤵
      PID:7060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52309.exe
        5⤵
        
        PID:9816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60107.exe
        5⤵
        
        PID:13940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42044.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42044.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17793.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17793.exe
      4⤵
      PID:12856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21445.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21445.exe
      4⤵
      PID:5908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52995.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52995.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31282.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31282.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60789.exe
        5⤵
        
        PID:1604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46242.exe
        6⤵
        
        PID:2432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58642.exe
        6⤵
        
        PID:11340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44605.exe
        6⤵
        
        PID:15268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53948.exe
        5⤵
        
        PID:6812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38628.exe
        6⤵
        
        PID:11976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-892.exe
        6⤵
        
        PID:5968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63355.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20677.exe
        5⤵
        
        PID:7940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25563.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25563.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45765.exe
        5⤵
        
        PID:9112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29997.exe
        5⤵
        
        PID:11364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55190.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52429.exe
        5⤵
        
        PID:18124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64611.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64611.exe
      4⤵
      PID:8060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38747.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38747.exe
      4⤵
      PID:11764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36068.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36068.exe
      4⤵
      PID:14024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62086.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62086.exe
      4⤵
      PID:13472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52444.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52444.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41957.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41957.exe
      4⤵
      PID:6112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63906.exe
        5⤵
        
        PID:6452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61419.exe
        6⤵
        
        PID:10072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2340.exe
        6⤵
        
        PID:224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30886.exe
        6⤵
        
        PID:17052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32285.exe
        5⤵
        
        PID:9256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63269.exe
        5⤵
        
        PID:14332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52307.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52307.exe
      4⤵
      PID:7352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6641.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6641.exe
      4⤵
      PID:11484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46012.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46012.exe
      4⤵
      PID:5940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29954.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29954.exe
    3⤵
    PID:5684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16341.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16341.exe
      4⤵
      PID:8108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34532.exe
        5⤵
        
        PID:14732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33477.exe
        5⤵
        
        PID:14544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24989.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24989.exe
      4⤵
      PID:10216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2812.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2812.exe
      4⤵
      PID:5604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58732.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58732.exe
    3⤵
    PID:6832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26388.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26388.exe
    3⤵
    PID:11320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12681.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12681.exe
    3⤵
    PID:12996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11837.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11837.exe
    3⤵
    PID:6416
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59612.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59612.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15409.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15409.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27826.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27826.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32642.exe
        5⤵
        
        PID:5356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64178.exe
        6⤵
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12900.exe
        7⤵
        
        PID:8944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12618.exe
        7⤵
        
        PID:12000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1660.exe
        7⤵
        
        PID:7840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51945.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10323.exe
        7⤵
        
        PID:14580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27237.exe
        7⤵
        
        PID:16656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32987.exe
        6⤵
        
        PID:12336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28946.exe
        6⤵
        
        PID:5476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40088.exe
        5⤵
        
        PID:7048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24738.exe
        6⤵
        
        PID:8640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18093.exe
        6⤵
        
        PID:12620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6101.exe
        6⤵
        
        PID:5352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53392.exe
        5⤵
        
        PID:8888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26459.exe
        5⤵
        
        PID:12816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35292.exe
        5⤵
        
        PID:5792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63129.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63129.exe
      4⤵
      PID:5664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3457.exe
        5⤵
        
        PID:3476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24738.exe
        6⤵
        
        PID:9100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22618.exe
        6⤵
        
        PID:12940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61286.exe
        6⤵
        
        PID:13848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56268.exe
        5⤵
        
        PID:9288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45582.exe
        5⤵
        
        PID:14144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34556.exe
        5⤵
        
        PID:17904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14735.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14735.exe
      4⤵
      PID:7204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35013.exe
        5⤵
        
        PID:9996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9178.exe
        5⤵
        
        PID:13644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25980.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20474.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63157.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63157.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26063.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26063.exe
      4⤵
      PID:4508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23528.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23528.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-929.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-929.exe
      4⤵
      PID:5644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3457.exe
        5⤵
        
        PID:4700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1380.exe
        6⤵
        
        PID:9660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47118.exe
        6⤵
        
        PID:12416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64853.exe
        5⤵
        
        PID:9732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57323.exe
        5⤵
        
        PID:12848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1000.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1000.exe
      4⤵
      PID:7212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19972.exe
        5⤵
        
        PID:10904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53374.exe
        5⤵
        
        PID:14204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56541.exe
        5⤵
        
        PID:7144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14609.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3597.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3597.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22796.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22796.exe
      4⤵
      PID:16772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18146.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18146.exe
    3⤵
    PID:5888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44005.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44005.exe
      4⤵
      PID:6916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6147.exe
        5⤵
        
        PID:12108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9674.exe
        5⤵
        
        PID:15184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13841.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13841.exe
      4⤵
      PID:10912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7437.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7437.exe
      4⤵
      PID:13720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14236.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14236.exe
      4⤵
      PID:5916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41737.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41737.exe
    3⤵
    PID:7720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2435.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2435.exe
      4⤵
      PID:14692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10325.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10325.exe
      4⤵
      PID:5584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23921.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23921.exe
    3⤵
    PID:10336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48541.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48541.exe
    3⤵
    PID:10120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53503.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53503.exe
    3⤵
    PID:17028
- C:\Users\Admin\AppData\Local\Temp\Unicorn-58176.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-58176.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27442.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27442.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51858.exe
      4⤵
      PID:5812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19301.exe
        5⤵
        
        PID:5444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34138.exe
        6⤵
        
        PID:11536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6565.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29313.exe
        5⤵
        
        PID:12144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4074.exe
        5⤵
        
        PID:15320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44943.exe
        5⤵
        
        PID:14440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12047.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12047.exe
      4⤵
      PID:8052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17402.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17402.exe
      4⤵
      PID:10592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50779.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50779.exe
      4⤵
      PID:15284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31620.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31620.exe
      4⤵
      PID:18232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32475.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32475.exe
    3⤵
    PID:5224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39781.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39781.exe
      4⤵
      PID:7488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21716.exe
        5⤵
        
        PID:12260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25133.exe
        5⤵
        
        PID:15332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41741.exe
        5⤵
        
        PID:7424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22970.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22970.exe
      4⤵
      PID:9912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31172.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31172.exe
      4⤵
      PID:12500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36284.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36284.exe
      4⤵
      PID:18288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52032.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52032.exe
    3⤵
    PID:6024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13310.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13310.exe
      4⤵
      PID:2628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45659.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45659.exe
    3⤵
    PID:11248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21060.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21060.exe
    3⤵
    PID:4460
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16859.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16859.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51858.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51858.exe
    3⤵
    PID:5828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49397.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49397.exe
      4⤵
      PID:8124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62287.exe
        5⤵
        
        PID:5460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26058.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26058.exe
      4⤵
      PID:2168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36482.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36482.exe
      4⤵
      PID:13344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14549.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14549.exe
      4⤵
      PID:16980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5608.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5608.exe
    3⤵
    PID:7664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38578.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38578.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9261.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9261.exe
      4⤵
      PID:14012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9260.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9260.exe
      4⤵
      PID:17188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26804.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26804.exe
    3⤵
    PID:10728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7437.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7437.exe
    3⤵
    PID:14068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36085.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36085.exe
    3⤵
    PID:8396
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44325.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44325.exe
  2⤵
  PID:6108
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6108 -s 628
    3⤵
    - Program crash
    PID:9036
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46871.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46871.exe
  2⤵
  PID:7640
- C:\Users\Admin\AppData\Local\Temp\Unicorn-65059.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-65059.exe
  2⤵
  PID:11284
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11546.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11546.exe
  2⤵
  PID:13544
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22619.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22619.exe
  2⤵
  PID:17020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 6108 -ip 6108
1⤵
PID:8748

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-12047.exe

Filesize
468KB

MD5
75190badab2d5cada5bf4f7c06347b04

SHA1
1603d663a5f39d1f7d2b27e7d0abd4d9837feac1

SHA256
93cb87e74bfde2942e2d1971fe7d0ecc0966c9b0fb90ce8609eb7b2402459aeb

SHA512
7edb7e317c571a513eb74d167b1fab542cb0eb8d863483886b05aae7682bc01a72d84f12c3596bfb4352169eb7f3ac51d69e85bf70aca2d11cc88121e813e42c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13489.exe

Filesize
468KB

MD5
198a39307ad9e2e04d75bd15a5bd4803

SHA1
1f0e9053e7d5fc2539f3ee9150f44ea272358474

SHA256
c178ff5039e0d8cc4bb13aae8617f963c5d5c568ee07a1f9a6399cd51fae88fa

SHA512
0625cf8ce480cc4bb410345f814356ef1d65587fe73699a011b479dc897a79e13e3a881d260fc45e7c02ee433d6e54f6cd5f6d77f7d2252b3207631ba8e4b19b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14267.exe

Filesize
468KB

MD5
fd31c9b692951b8e72d576903e0003d6

SHA1
009ad57bb4ce37aa2193d46acd368cf0b51ea200

SHA256
4530487d8a40ee89e79919da303c74c7b8742bb1d914253eb54f4191285f6d5d

SHA512
5b89d9a8408117f722ed78b60fa0739e2af65d5849e625f4e4d56ea631918dfa7df34967ab311402be51073475ff7dc4d5dadc3017ffb08faea23324ba96e923

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14916.exe

Filesize
468KB

MD5
0005200ade6745446acd46af04023e56

SHA1
4832a187a7b63c4d07f594fb44e06195c3fe5ebe

SHA256
e0ea5fdb4115babdbf6ce7cc3e559a80a1597c7c4653be682141d554b12243fe

SHA512
2b7221666a146ec3d2623a4ae46d052e768b3e14a5e11d9dd09b9549547d3d6934e0c6c21cadc106cc076fe0d1cf16b4e8759527776f558d68846176d691c1a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15409.exe

Filesize
468KB

MD5
5fbbf1b87971a45d01e248de3b324c12

SHA1
fa97999ab3fc7bb07c99e342fdc3719c03e2e90f

SHA256
809160f9348dd1170cd7544e0fedf0be772b017950d37cf1914f136814773d81

SHA512
5ff6b6034faa07d285efad7511aa886e9ce8ef1eb536f3f267f05fdda3f491eb6bce3d7719dde009a77093e09d89edc7199227e49bfeb7c17197f4a769d03827

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17026.exe

Filesize
468KB

MD5
9a21306659f4953e5953b60cede173d9

SHA1
f8051c440e585341e9b5d0d558bd18769f9959da

SHA256
6bfb3eb7acf4895763bc17aa8a9e6a294a249c9b0bbbf722820e9d0456991f6c

SHA512
4ddbf56c3820d7990f0481b78a4a22cd82c586003ed53ae2a0d2553205805b83a368fb7748763762cc3adee60742a0bbfcac179ec35a62e74d4f5847d0c696aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23311.exe

Filesize
468KB

MD5
5b850164788229a3546053a7d8ea5b83

SHA1
db99fdb25e6c08ec0b368f7777823c7026f934fc

SHA256
002573e5428391a0f1f4048397eef99d153c0587ab0ea0c919746be0939d69c3

SHA512
6c070b54f5844a1f70b4e6629b030c555a73d43c48a5621b5ae1e8873605d70090ef09df34021c8e1fdda8b942a659692b77f3ebb773ec143b39124f35204177

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24389.exe

Filesize
468KB

MD5
59b558e87fcf9507af5154bc5454c1e7

SHA1
e70d2ce543d99c952e9926d24170b14086fbebe6

SHA256
1a2038037ff2f4d93fc4bf28b2a43c6d92293d15bfb7ffea53ce4df6aed34342

SHA512
1b851458aba594a197111a71f9c6bd8510d52dd2e8b8992628b9fe47f45a4312f64b0a5f55ffaccf11cf2a600864f047a23dccefaa495a6164bbc2931c1ee3a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26104.exe

Filesize
468KB

MD5
2e4e1f38ed37606ef746be901f8b58d9

SHA1
ddb81f1ba1b0d83bca588b0ba897aec686d2ec6b

SHA256
8afc063d24f23337a9b0d597ac7920f1837e2e14330a81a9a177763be92fc6c2

SHA512
53b1e66c7065d01100585eb0216e9fbf8b8f6ebbeae730642be6dfa79e759d91f4d981eeb23c5b399c40c4eea7362754d83bbf531f889a57b50d6c390d3b1be5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26837.exe

Filesize
468KB

MD5
d2d7d89a4f4c9e22bc777b6970cd00ec

SHA1
5bf0dce996ccdd58c97b8cd383822c2252f9c57b

SHA256
d061523816f8840e609932a786a0719c650965aa27246eac434484bbbfab5a2c

SHA512
38e2a786f133b810548ff90a32fd279eea13ff07b0934d7ec9b7f23092b79fd87752a3cedeb09ad5476cef31bf3d4083ca2239f4b1f117417bbbdb0a8a563749

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27314.exe

Filesize
468KB

MD5
eaf6add2495068121b063bc1a37556ae

SHA1
0fd43b0298160ec8fbc2d46d0554b1e017c67936

SHA256
a793b7dbea2a0350ce74f7136041934247e2f53dd9c73c91db8aa5f33681d48b

SHA512
2ba1a90ba345bd6c9ae7f1cd74cf23df98193176f7ef70a8d8d77184a113bac703d22fdcb5caac38a9ed6e502ed758b3e31ea42c48c39cb20e92de82ef720c54

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28408.exe

Filesize
468KB

MD5
2a3eafab97317acc3163e1bf095433dc

SHA1
6cd21dba453ac14cd36cc693fc5d1df80ce4ee3d

SHA256
61af92e1f203f57847b75663cdead29f1b4560e4deec9dd0b281c3aa6b624a24

SHA512
0ef9c9e077f12b37a403cc5ec1976f9c834b19556ffbe9c5bfdf37cacc31518f1b6832f95eb86ecd3b5cdebde777b19af3f5bc443f3c00ec0a39ea2a2a546c0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29298.exe

Filesize
468KB

MD5
64f11b2ef1f8ce8e67a93b9f165fdf9c

SHA1
1e31f2c4bc55106f783e41c8ec6048ac4da8fded

SHA256
d1a06385536f7ad1e19facece5acf6a15a015215fbb15c7186d45e1d468b6768

SHA512
84621e3a78a9e3f85fb05b6f087357ae7db364bc315ce6c2377326fac36086cc9bc47abdddbb8aeaef95c6c2a3afc928b5f2c8ae2f9e0fb3733d5e9fdf285e18

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31746.exe

Filesize
468KB

MD5
23892c7718a07c71ed8475008cdce617

SHA1
33d61e15f6e0577b9785d38200ab8b4fac5d0d14

SHA256
30f253b07bfbbab40525284bcfba2a986f8d05e276d2e0a9dad20b05521b272d

SHA512
12fc0c90e5e33535d57de34bab7158687df7cdcc3cf9072e6b74ae611c28ff96d4870e69df46174a383c26b2d28ff239de162b339564e12037fc2477fa22c6ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36472.exe

Filesize
468KB

MD5
d9899a1f80478f95a914ef16390239e7

SHA1
3159eb5f966bd00cb4a1e59259f801b53503be9a

SHA256
8869c2fed291deb4c71a9ddb6fc4f0b02255944481007a8351220b1950da0668

SHA512
368dfa10d55763f4eb46f0f00c73806f158ca386221d009808c8f3cf1fcc64e80c7a8be94500b1eb4506c1961b3fa977431622e858656851c16e440f1f5331cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37920.exe

Filesize
468KB

MD5
476353e8396d5950f99ca53ba9c3d13e

SHA1
85d29b5eedc7259d4f0c5af99e73358901ffac53

SHA256
05125f89c552bf868e8c0d06415866324b245f772b9fec71689b3be591bd3c10

SHA512
9037f739d49f7fce84b06d96a0b9913d1020c7b3804743979a2280f491f27650ef540f43b0be848102eb1b0391f461c59caf148003d9b314072c141e17d0eb66

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38741.exe

Filesize
468KB

MD5
b4c545d4e74e0fb7e78172dccf05e9a8

SHA1
c8e1356c20705ccaac70bc14b219e1b9e8441ff9

SHA256
f875a1d4f17f362ae4247ad24ad093b0734a4383230a24b3c0f575247e39d455

SHA512
4c01ea9c84c0cb46b7e516671889548c493664c0e15b1cbfd5fe6973284974547e739a6803acf3f3904e2ffff60a1154a278dd662e0b667f5f65638167fdc6e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39877.exe

Filesize
468KB

MD5
51cb67fd05da14e831f8be45ba2dc356

SHA1
9b2e406a59db2d7f0102a584388ea0a9e4b9f88b

SHA256
b7c2af1ea58263dab621cfda37b9515aa585537de75b50e7d6ba54ec7521d895

SHA512
32e4deec548441716ec34f3ac7ad3783099ccdf3c0d7e743a6bf0a8ada316e6e3401ff9309415a954c582b18ad9e7d20c64ee70ccdd3fa619ee3ee020f198a0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40011.exe

Filesize
468KB

MD5
8154478679b7df13692c29d21d5237ec

SHA1
35cbe50bd46226b0bb8db83054c24537b87132af

SHA256
8624a93949d2539bb52b931b746836d6a09464f92051f4f4a6625c9a5ab36982

SHA512
ae68791eaff1bac5288d7539a30878e6da5c66545e70e62666534d27170039e634ef52b6012349e745b37eb016abf336c812b587770f3e9247f8a5ef8b62c0d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40088.exe

Filesize
468KB

MD5
5b9dc87670515a392cebd49beaef4626

SHA1
c7229769d4911a9eb6c9e081b02594565d1b54b3

SHA256
c629968f5effc0dfe84fe5d5ccaca5e409b89a771fa6902408acfa7b01a62966

SHA512
6699831446e67623e8aae60a3adb9f3f4efb2e27ed707af9dec51c64c6355d92d6670a14dcbf39b3717167efdad5d9e82413d42eedde9f8c5ff1b46124147386

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42144.exe

Filesize
468KB

MD5
07e0b5a642fcd765af573237d8bab66a

SHA1
bc8071902a98af174f8521ba69ace152090fd644

SHA256
8fb4f532050814d501e3cb3f8630e88d7abfaacc5f120d26bc7db4895063d370

SHA512
d19e692e7e5edebf2ca9c5811483c1698b743feb313e2207a0eeac62e92109bcfa889f252eaba576d84e470b3c6ade25b5858bc8dd4701975b8534413fb18ff5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43733.exe

Filesize
468KB

MD5
f6e602844cf7747a15cffd2e2eaac034

SHA1
085cc4a42fc7c026a6d77ba48912dd264c174b1d

SHA256
9286ad3750a3f2eeb220912647ac2387a1be52e8e5729c0460121f0f3bebfb5f

SHA512
1992f3eaba6fb64812d425db2a5ebad5a82edb8447655e21f072d7a755e46a9ba2c8b1edf7bce03f1ff8114a1301d54b4c4273735c1628811be1405b1f9a0590

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44050.exe

Filesize
468KB

MD5
8f208ba06206635d559fce3c42f75d34

SHA1
2c650764ed2e518387f86ee7b8c67eece8b8557c

SHA256
0e232459392a42dc4e3d376275bab8c14dff2115a7d29fecc5e3d341d2f6b30f

SHA512
13e0ad031bf52c46b19b106212b70c83e62204e61d047a50d6ccc675e22dcd1deb46ca5f0d392389a8c5fce4f2d57b9d1baca3870e22313d5116d8364dd38337

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52300.exe

Filesize
468KB

MD5
a6c71a7106696d7bfe62314ac61db45f

SHA1
031153c07aef4bd1fa2c2ae03365cb841d0d7f42

SHA256
4b84805fefd64bd081016c3df7c7feb4fde0b109c6a7cbcd048a5382adf01ef0

SHA512
3312b9410be523f8fcbee126b4be99bd3eb7e3ec5a08868a4bc9c84ae98694ee0fe176109f221466ec7398cf5602c917589cc27bfaa44fadd2391282edbd4504

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53747.exe

Filesize
468KB

MD5
10d01dfe93c957854bea7d60d0f736e2

SHA1
3d6af9675514433ab5afb31f99bc4e770bc11eca

SHA256
66cdd6ce584ae7be34623848f8121e14e53d5ca64e5818344a070697c8de53a4

SHA512
c6a291b9ed2af13cf63fedd26022bcdb6ed36146a7f2a54aa9e08c7e88cefe10d38a65736fa6d51b384aeb062659977cc0fd128fbb7f0195ba2e4da5e67cd264

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54290.exe

Filesize
468KB

MD5
c8763c0e6b4c20cdc4d3bdfe7d4a1c31

SHA1
2ca2e10d786cc75a27598a508c5e6ff825d948d2

SHA256
74153ce0113eea97b04b676b49ea506bcc3486c1fe7aa718d07c804f42ce6dde

SHA512
35cbae6221dd2095faa477695f3e266667a3ff8278c3684c805c81da07e30bf89de27ebb1ab4512e6d4f03792639b12f092d78084973b057ad1ff75af7afe1c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55004.exe

Filesize
468KB

MD5
06015edd8469e6f84021359afcdade42

SHA1
f09a8467dbc315fbf2ec4fb3be027110ced15d04

SHA256
9182534e1363b9d6c2699b8c8def31efd95ba710b46f87b09d01e327b96127d2

SHA512
056a294d2a520b985965df4f1814afad581d4d74bcb9f54ce0ed17f2ef735962691884ed1ae7e11a5e4d5530de2a6e7fabd327472eb73f0d562cf45c3130ffec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58176.exe

Filesize
468KB

MD5
bf1767f6636c03154b1c1d031cd7b3cc

SHA1
f494a3097ddb22392147e13a4f714f128ef69c02

SHA256
d2b1e5495e699f59a34d122918c0b4566df2a75c1aa218389627988925c1b86a

SHA512
f1152a96e03b47975f6e1937239cfc59bf93d3a903c0ab7418b80a564cd64ef4a7bff5482bb4a111140e09fb8a4f35da0265c948e84b37578d34e5c7cb418de0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59612.exe

Filesize
468KB

MD5
b14a5a3994a459202820386f443ed801

SHA1
e69ca2b38d5e76378d04e38a611bcef1ca4bb9a5

SHA256
d4b3a84e1e5487bfdc32c56f2735dbffcbb6d1920a1b8fe490eb00f508446b6d

SHA512
4fb425fb267a58bc84da08a0d2e9ac51d8e2d9ae8d5b5c510bd8a75aa22bff00d1bd0c674bfa86fa212d106daec93ed414a2eb526a80c92e8f5c30df0286dbb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60261.exe

Filesize
468KB

MD5
83cb0a250e0f613a2bfaa81e0fdc2b3c

SHA1
fb4b694e97e9e2f367ebe58d56e2b26f7c632666

SHA256
b228ba309a46fc1cd1a7359aedb808be96c3cdc52c55a754c56fc6dcaed702ee

SHA512
9c3ececf132a4b66ec1466ad6f8af136326344de5903a285b8eae341b255d5a2e74076f1156d8ded9c10a3a2985b61b73b841b715a600334bbb206f0a83dda35

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60578.exe

Filesize
468KB

MD5
50ba57d0493bb45ab84aeffb08980ef7

SHA1
8484389f89bb91af67fe664e4a36a09b93df5257

SHA256
01cec06797768db5d2a490bb383eb980e561de6011153e73f82426bf82641520

SHA512
4a5cac71572fa14045a6d176be8188db37c0540153a202d1d4be3123b4b21e9c4ab6a3b117b451fae7a587d2d273c8706c38462483aceb32235e8accea1c3f61

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61419.exe

Filesize
468KB

MD5
a10fd0269e48556e76397b5ae43cdd24

SHA1
90db4dabbfae59f0f1ef4b49be9a7bb740340d65

SHA256
79173ec67b478bc4d96965beedde3f0eda9ccae98f7028a1a479bcb7e3aa893f

SHA512
dbc3f88f199c24f94c90d9b4c36124d7e67be96735ac153da991340263425486962e32cfa8ef2d7b86d760fd487028082599c08c23563a510abac852fae191a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6628.exe

Filesize
468KB

MD5
632801f88dcf801535c6e8e3794de875

SHA1
553a809f168200b0e93ec64c910cdb6dd1f7a688

SHA256
57825110174e790b93333fbe5b60338fb5a8fbe81e4912a11ea56a23fbda0124

SHA512
f6b66f4a983c7a94289d7454a4550a0d2e227ee707d68cfbf62ce61e8fc5d332ba823cda2c6397c74c43a98fbc539e63cf40ca5ac8e604ed8b5ffecc2db55967

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-683.exe

Filesize
468KB

MD5
2bb4c69c87cb4ee5b09b8b01741946f1

SHA1
96e1a8f47e91778fce338d47feb4647e2e5ab999

SHA256
d7af3d9e4fb4414d6503a202c70ab6a35465e7eeaaf9a1b75df41a57ef0825f6

SHA512
0cdba07b845cf9e753fff45d2ac6f6e3c4fc4f7319b67cc76c921b418e6be5d0288ed66e60adf48202d8ce8e573cefc85740cf7150546e6345161c5eaa6826a2

Download Submit
memory/116-322-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/416-360-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/672-373-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/748-381-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/968-397-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1008-412-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1020-316-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1092-69-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1124-167-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1148-374-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1160-362-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1308-226-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1332-179-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1388-323-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1476-114-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1540-315-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1544-304-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1564-287-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1672-270-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1704-133-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2376-166-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2424-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2612-106-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2692-390-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2696-94-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2784-178-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2872-317-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2884-95-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3012-241-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3032-91-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3080-56-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3148-389-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3156-141-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3232-232-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3244-234-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3308-305-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3504-233-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3656-63-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3668-283-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3696-242-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3880-231-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3896-269-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3932-354-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3940-410-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3992-363-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4216-83-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4304-121-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4312-409-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4332-207-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4368-284-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4420-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4448-324-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4476-349-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4552-411-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4556-180-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4656-47-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4728-130-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4748-258-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4784-15-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4804-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4824-365-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4892-382-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4920-353-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4924-208-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4932-42-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4944-182-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5028-288-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5040-41-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5072-257-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5092-418-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5112-21-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5132-414-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5340-455-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5356-457-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5376-465-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5392-481-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5404-485-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5424-499-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5432-500-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5452-503-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5492-539-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5608-579-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5616-508-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5644-509-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5664-512-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5724-580-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5752-581-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5764-513-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5772-515-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5800-516-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5812-524-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5840-535-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5864-536-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5888-537-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5896-538-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5952-582-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/13564-2531-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14024-2530-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15456-2529-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads