4ba25017fdf8c8bd19684aafc12cfe095da0d730e1d89a02988fcd022f236b14

Analysis

max time kernel
120s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2024, 03:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4ba25017fdf8c8bd19684aafc12cfe095da0d730e1d89a02988fcd022f236b14N.exe
Size

468KB
MD5

74684f7164457576e6f8dae44f41f4e0
SHA1

7f8fb6ff4499c012aa21349a98e315a4104a7b2c
SHA256

4ba25017fdf8c8bd19684aafc12cfe095da0d730e1d89a02988fcd022f236b14
SHA512

84bd52a904a4b20318ab9e335ff61f991b2fe6e65fc04a4a97bef0f4ebfbd69edb519ecde8bbd1d16942a405d492c3f03c56cb99535781f400e4e4f8a6ddc946
SSDEEP

3072:ariOogfxRg8U2bYRPW3cqf8/EC3jyIgZswfI+V8jEmo+rSWct5Mm:arHoCNU2yPscqfRVQrEmPeWct

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2912	Unicorn-61664.exe
1404	Unicorn-61280.exe
3608	Unicorn-62328.exe
2076	Unicorn-61008.exe
764	Unicorn-24614.exe
4952	Unicorn-44480.exe
4372	Unicorn-5869.exe
3388	Unicorn-47376.exe
1000	Unicorn-43847.exe
536	Unicorn-33344.exe
5116	Unicorn-30198.exe
1544	Unicorn-863.exe
1332	Unicorn-17200.exe
3144	Unicorn-49223.exe
4700	Unicorn-15646.exe
4812	Unicorn-3375.exe
3288	Unicorn-62206.exe
2488	Unicorn-35280.exe
1980	Unicorn-52856.exe
3776	Unicorn-7184.exe
2856	Unicorn-51159.exe
4808	Unicorn-9629.exe
4396	Unicorn-14733.exe
4508	Unicorn-20864.exe
4036	Unicorn-998.exe
3316	Unicorn-20864.exe
4636	Unicorn-20864.exe
4676	Unicorn-20864.exe
1512	Unicorn-12342.exe
3060	Unicorn-11661.exe
2472	Unicorn-11661.exe
3560	Unicorn-33360.exe
2464	Unicorn-49888.exe
2456	Unicorn-49888.exe
2636	Unicorn-36182.exe
3120	Unicorn-39255.exe
4900	Unicorn-52327.exe
2980	Unicorn-59504.exe
3772	Unicorn-26448.exe
2296	Unicorn-20509.exe
4732	Unicorn-26640.exe
3636	Unicorn-42976.exe
1520	Unicorn-10111.exe
636	Unicorn-10111.exe
936	Unicorn-10111.exe
1756	Unicorn-26256.exe
3540	Unicorn-6006.exe
1748	Unicorn-58663.exe
448	Unicorn-58928.exe
928	Unicorn-49798.exe
4192	Unicorn-55399.exe
1704	Unicorn-797.exe
752	Unicorn-55399.exe
436	Unicorn-63505.exe
4416	Unicorn-54823.exe
4932	Unicorn-22342.exe
3892	Unicorn-3021.exe
3836	Unicorn-32704.exe
4640	Unicorn-10429.exe
4476	Unicorn-36736.exe
1252	Unicorn-8951.exe
1460	Unicorn-36087.exe
1904	Unicorn-35776.exe
4368	Unicorn-35968.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6088	1260	WerFault.exe	167

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12265.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12265.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7650.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39255.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23543.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26355.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36561.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46723.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36059.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58278.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8951.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19309.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65479.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44362.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58202.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62865.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38431.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11305.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30905.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16315.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4ba25017fdf8c8bd19684aafc12cfe095da0d730e1d89a02988fcd022f236b14N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42332.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51306.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15435.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52186.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35350.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56849.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6167.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35968.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56163.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17833.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26640.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11727.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4733.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43854.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44362.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11183.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61674.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51696.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17046.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8180.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43280.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18256.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40623.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23648.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40960.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43456.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11584.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63505.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21568.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19161.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15511.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59354.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7250.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42332.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5869.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41952.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48880.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32441.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16121.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29561.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21646.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12621.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-240.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	2992	dwm.exe
Token: SeChangeNotifyPrivilege	2992	dwm.exe
Token: 33	2992	dwm.exe
Token: SeIncBasePriorityPrivilege	2992	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4324	4ba25017fdf8c8bd19684aafc12cfe095da0d730e1d89a02988fcd022f236b14N.exe
2912	Unicorn-61664.exe
1404	Unicorn-61280.exe
3608	Unicorn-62328.exe
4952	Unicorn-44480.exe
2076	Unicorn-61008.exe
764	Unicorn-24614.exe
4372	Unicorn-5869.exe
3388	Unicorn-47376.exe
1000	Unicorn-43847.exe
3144	Unicorn-49223.exe
536	Unicorn-33344.exe
1332	Unicorn-17200.exe
5116	Unicorn-30198.exe
1544	Unicorn-863.exe
4700	Unicorn-15646.exe
4812	Unicorn-3375.exe
3288	Unicorn-62206.exe
2488	Unicorn-35280.exe
4808	Unicorn-9629.exe
3776	Unicorn-7184.exe
1980	Unicorn-52856.exe
2856	Unicorn-51159.exe
3316	Unicorn-20864.exe
4636	Unicorn-20864.exe
4508	Unicorn-20864.exe
4036	Unicorn-998.exe
4396	Unicorn-14733.exe
4676	Unicorn-20864.exe
1512	Unicorn-12342.exe
2472	Unicorn-11661.exe
3560	Unicorn-33360.exe
2456	Unicorn-49888.exe
2464	Unicorn-49888.exe
2636	Unicorn-36182.exe
4900	Unicorn-52327.exe
3120	Unicorn-39255.exe
2980	Unicorn-59504.exe
3772	Unicorn-26448.exe
4732	Unicorn-26640.exe
2296	Unicorn-20509.exe
3636	Unicorn-42976.exe
1520	Unicorn-10111.exe
636	Unicorn-10111.exe
1748	Unicorn-58663.exe
1756	Unicorn-26256.exe
936	Unicorn-10111.exe
1704	Unicorn-797.exe
928	Unicorn-49798.exe
3892	Unicorn-3021.exe
4416	Unicorn-54823.exe
4192	Unicorn-55399.exe
436	Unicorn-63505.exe
752	Unicorn-55399.exe
448	Unicorn-58928.exe
3540	Unicorn-6006.exe
4932	Unicorn-22342.exe
3836	Unicorn-32704.exe
4640	Unicorn-10429.exe
3100	Unicorn-20592.exe
4476	Unicorn-36736.exe
1252	Unicorn-8951.exe
1460	Unicorn-36087.exe
972	Unicorn-2454.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4324 wrote to memory of 2912	4324	4ba25017fdf8c8bd19684aafc12cfe095da0d730e1d89a02988fcd022f236b14N.exe	82
PID 4324 wrote to memory of 2912	4324	4ba25017fdf8c8bd19684aafc12cfe095da0d730e1d89a02988fcd022f236b14N.exe	82
PID 4324 wrote to memory of 2912	4324	4ba25017fdf8c8bd19684aafc12cfe095da0d730e1d89a02988fcd022f236b14N.exe	82
PID 2912 wrote to memory of 1404	2912	Unicorn-61664.exe	85
PID 2912 wrote to memory of 1404	2912	Unicorn-61664.exe	85
PID 2912 wrote to memory of 1404	2912	Unicorn-61664.exe	85
PID 4324 wrote to memory of 3608	4324	4ba25017fdf8c8bd19684aafc12cfe095da0d730e1d89a02988fcd022f236b14N.exe	86
PID 4324 wrote to memory of 3608	4324	4ba25017fdf8c8bd19684aafc12cfe095da0d730e1d89a02988fcd022f236b14N.exe	86
PID 4324 wrote to memory of 3608	4324	4ba25017fdf8c8bd19684aafc12cfe095da0d730e1d89a02988fcd022f236b14N.exe	86
PID 1404 wrote to memory of 2076	1404	Unicorn-61280.exe	89
PID 1404 wrote to memory of 2076	1404	Unicorn-61280.exe	89
PID 1404 wrote to memory of 2076	1404	Unicorn-61280.exe	89
PID 2912 wrote to memory of 764	2912	Unicorn-61664.exe	90
PID 2912 wrote to memory of 764	2912	Unicorn-61664.exe	90
PID 2912 wrote to memory of 764	2912	Unicorn-61664.exe	90
PID 3608 wrote to memory of 4952	3608	Unicorn-62328.exe	91
PID 3608 wrote to memory of 4952	3608	Unicorn-62328.exe	91
PID 3608 wrote to memory of 4952	3608	Unicorn-62328.exe	91
PID 4324 wrote to memory of 4372	4324	4ba25017fdf8c8bd19684aafc12cfe095da0d730e1d89a02988fcd022f236b14N.exe	92
PID 4324 wrote to memory of 4372	4324	4ba25017fdf8c8bd19684aafc12cfe095da0d730e1d89a02988fcd022f236b14N.exe	92
PID 4324 wrote to memory of 4372	4324	4ba25017fdf8c8bd19684aafc12cfe095da0d730e1d89a02988fcd022f236b14N.exe	92
PID 4952 wrote to memory of 3388	4952	Unicorn-44480.exe	96
PID 4952 wrote to memory of 3388	4952	Unicorn-44480.exe	96
PID 4952 wrote to memory of 3388	4952	Unicorn-44480.exe	96
PID 3608 wrote to memory of 1000	3608	Unicorn-62328.exe	97
PID 3608 wrote to memory of 1000	3608	Unicorn-62328.exe	97
PID 3608 wrote to memory of 1000	3608	Unicorn-62328.exe	97
PID 1404 wrote to memory of 5116	1404	Unicorn-61280.exe	98
PID 1404 wrote to memory of 5116	1404	Unicorn-61280.exe	98
PID 1404 wrote to memory of 5116	1404	Unicorn-61280.exe	98
PID 2076 wrote to memory of 536	2076	Unicorn-61008.exe	99
PID 2076 wrote to memory of 536	2076	Unicorn-61008.exe	99
PID 2076 wrote to memory of 536	2076	Unicorn-61008.exe	99
PID 4372 wrote to memory of 1544	4372	Unicorn-5869.exe	100
PID 4372 wrote to memory of 1544	4372	Unicorn-5869.exe	100
PID 4372 wrote to memory of 1544	4372	Unicorn-5869.exe	100
PID 764 wrote to memory of 1332	764	Unicorn-24614.exe	101
PID 764 wrote to memory of 1332	764	Unicorn-24614.exe	101
PID 764 wrote to memory of 1332	764	Unicorn-24614.exe	101
PID 4324 wrote to memory of 3144	4324	4ba25017fdf8c8bd19684aafc12cfe095da0d730e1d89a02988fcd022f236b14N.exe	102
PID 4324 wrote to memory of 3144	4324	4ba25017fdf8c8bd19684aafc12cfe095da0d730e1d89a02988fcd022f236b14N.exe	102
PID 4324 wrote to memory of 3144	4324	4ba25017fdf8c8bd19684aafc12cfe095da0d730e1d89a02988fcd022f236b14N.exe	102
PID 2912 wrote to memory of 4700	2912	Unicorn-61664.exe	103
PID 2912 wrote to memory of 4700	2912	Unicorn-61664.exe	103
PID 2912 wrote to memory of 4700	2912	Unicorn-61664.exe	103
PID 1000 wrote to memory of 4812	1000	Unicorn-43847.exe	104
PID 1000 wrote to memory of 4812	1000	Unicorn-43847.exe	104
PID 1000 wrote to memory of 4812	1000	Unicorn-43847.exe	104
PID 3608 wrote to memory of 3288	3608	Unicorn-62328.exe	105
PID 3608 wrote to memory of 3288	3608	Unicorn-62328.exe	105
PID 3608 wrote to memory of 3288	3608	Unicorn-62328.exe	105
PID 4700 wrote to memory of 2488	4700	Unicorn-15646.exe	106
PID 4700 wrote to memory of 2488	4700	Unicorn-15646.exe	106
PID 4700 wrote to memory of 2488	4700	Unicorn-15646.exe	106
PID 3144 wrote to memory of 3776	3144	Unicorn-49223.exe	108
PID 3144 wrote to memory of 3776	3144	Unicorn-49223.exe	108
PID 3144 wrote to memory of 3776	3144	Unicorn-49223.exe	108
PID 4952 wrote to memory of 1980	4952	Unicorn-44480.exe	107
PID 4952 wrote to memory of 1980	4952	Unicorn-44480.exe	107
PID 4952 wrote to memory of 1980	4952	Unicorn-44480.exe	107
PID 2912 wrote to memory of 2856	2912	Unicorn-61664.exe	109
PID 2912 wrote to memory of 2856	2912	Unicorn-61664.exe	109
PID 2912 wrote to memory of 2856	2912	Unicorn-61664.exe	109
PID 4324 wrote to memory of 4808	4324	4ba25017fdf8c8bd19684aafc12cfe095da0d730e1d89a02988fcd022f236b14N.exe	110

C:\Users\Admin\AppData\Local\Temp\4ba25017fdf8c8bd19684aafc12cfe095da0d730e1d89a02988fcd022f236b14N.exe
"C:\Users\Admin\AppData\Local\Temp\4ba25017fdf8c8bd19684aafc12cfe095da0d730e1d89a02988fcd022f236b14N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4324
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61664.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61664.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61280.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61280.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61008.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61008.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33344.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20864.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26640.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29248.exe
        8⤵
        
        PID:1260
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 644
        9⤵
        Program crash
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35350.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3071.exe
        9⤵
        
        PID:8644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37537.exe
        9⤵
        
        PID:13196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42332.exe
        9⤵
        
        PID:16424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5213.exe
        8⤵
        
        PID:8352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1497.exe
        8⤵
        
        PID:13304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30018.exe
        8⤵
        
        PID:3228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26678.exe
        7⤵
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19309.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28967.exe
        8⤵
        
        PID:8348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32427.exe
        8⤵
        
        PID:13572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8180.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65422.exe
        7⤵
        
        PID:5608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4623.exe
        8⤵
        
        PID:9220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23225.exe
        8⤵
        
        PID:13256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24837.exe
        8⤵
        
        PID:17428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3014.exe
        7⤵
        
        PID:8612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2448.exe
        7⤵
        
        PID:12800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32699.exe
        7⤵
        
        PID:15564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55399.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53472.exe
        7⤵
        
        PID:5136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13711.exe
        8⤵
        
        PID:6448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3071.exe
        9⤵
        
        PID:8780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44362.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:12772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39430.exe
        9⤵
        
        PID:15420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7650.exe
        9⤵
        
        PID:5304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43854.exe
        8⤵
        
        PID:9972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3817.exe
        8⤵
        
        PID:13908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33666.exe
        8⤵
        
        PID:2608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39782.exe
        7⤵
        
        PID:7296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26544.exe
        8⤵
        
        PID:11068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5753.exe
        8⤵
        
        PID:15244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9403.exe
        8⤵
        
        PID:16220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16765.exe
        7⤵
        
        PID:10388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5545.exe
        7⤵
        
        PID:12236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33666.exe
        7⤵
        
        PID:4840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27549.exe
        6⤵
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40055.exe
        7⤵
        
        PID:7936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40314.exe
        7⤵
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4450.exe
        7⤵
        
        PID:548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25870.exe
        7⤵
        
        PID:17192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39511.exe
        6⤵
        
        PID:7840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4352.exe
        6⤵
        
        PID:11916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26777.exe
        6⤵
        
        PID:15532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51306.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11661.exe
        5⤵
        Executes dropped EXE
        
        PID:3060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20592.exe
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8303.exe
        7⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21917.exe
        8⤵
        
        PID:6276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42899.exe
        9⤵
        
        PID:12340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23115.exe
        9⤵
        
        PID:1236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32392.exe
        8⤵
        
        PID:10544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47441.exe
        8⤵
        
        PID:15000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8180.exe
        8⤵
        
        PID:12204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39782.exe
        7⤵
        
        PID:7304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42880.exe
        8⤵
        
        PID:11056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5753.exe
        8⤵
        
        PID:15280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9403.exe
        8⤵
        
        PID:15700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21534.exe
        7⤵
        
        PID:10504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35333.exe
        7⤵
        
        PID:12132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33666.exe
        7⤵
        
        PID:768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47831.exe
        6⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53265.exe
        7⤵
        
        PID:7056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44400.exe
        8⤵
        
        PID:8264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44362.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57494.exe
        8⤵
        
        PID:15972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52407.exe
        7⤵
        
        PID:10008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29194.exe
        7⤵
        
        PID:11452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46547.exe
        7⤵
        
        PID:2400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21229.exe
        6⤵
        
        PID:7692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40311.exe
        6⤵
        
        PID:10824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16688.exe
        6⤵
        
        PID:15296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8180.exe
        6⤵
        
        PID:6080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8951.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26176.exe
        6⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65216.exe
        7⤵
        
        PID:6892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25795.exe
        8⤵
        
        PID:12480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55596.exe
        8⤵
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35302.exe
        7⤵
        
        PID:9416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6976.exe
        7⤵
        
        PID:11556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42332.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56695.exe
        6⤵
        
        PID:7676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43456.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36505.exe
        7⤵
        
        PID:15012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16315.exe
        7⤵
        
        PID:18344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51166.exe
        6⤵
        
        PID:10708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16121.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56652.exe
        6⤵
        
        PID:15440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1885.exe
        5⤵
        
        PID:5180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52391.exe
        6⤵
        
        PID:7908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7152.exe
        6⤵
        
        PID:11928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37370.exe
        6⤵
        
        PID:15712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28098.exe
        6⤵
        
        PID:17520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60823.exe
        5⤵
        
        PID:7740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52547.exe
        5⤵
        
        PID:11756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22696.exe
        5⤵
        
        PID:15440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43651.exe
        5⤵
        
        PID:15684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-587.exe
        5⤵
        
        PID:17280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30198.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30198.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20864.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10111.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37712.exe
        7⤵
        
        PID:3800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48151.exe
        8⤵
        
        PID:6244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26526.exe
        8⤵
        
        PID:10636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56106.exe
        8⤵
        
        PID:15068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56652.exe
        8⤵
        
        PID:5456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15478.exe
        7⤵
        
        PID:7884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42810.exe
        7⤵
        
        PID:11456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25056.exe
        7⤵
        
        PID:12356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7300.exe
        7⤵
        
        PID:16708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56824.exe
        6⤵
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54033.exe
        7⤵
        
        PID:6844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56849.exe
        8⤵
        
        PID:8744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28793.exe
        8⤵
        
        PID:12660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7250.exe
        8⤵
        
        PID:15540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1323.exe
        8⤵
        
        PID:16780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49335.exe
        7⤵
        
        PID:9348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6400.exe
        7⤵
        
        PID:13332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56163.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41435.exe
        7⤵
        
        PID:8904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4701.exe
        6⤵
        
        PID:7604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57096.exe
        7⤵
        
        PID:4992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55111.exe
        6⤵
        
        PID:10512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26667.exe
        6⤵
        
        PID:12148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53452.exe
        6⤵
        
        PID:15576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23252.exe
        6⤵
        
        PID:17084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54823.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37712.exe
        6⤵
        
        PID:3784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48688.exe
        7⤵
        
        PID:7000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1933.exe
        8⤵
        
        PID:11772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32377.exe
        8⤵
        
        PID:15548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7650.exe
        8⤵
        
        PID:18320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52407.exe
        7⤵
        
        PID:10000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61761.exe
        7⤵
        
        PID:13532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6581.exe
        7⤵
        
        PID:16544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64487.exe
        6⤵
        
        PID:7020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5997.exe
        6⤵
        
        PID:10264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56106.exe
        6⤵
        
        PID:15032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9074.exe
        6⤵
        
        PID:17476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16205.exe
        5⤵
        
        PID:5232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47344.exe
        6⤵
        
        PID:6664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52272.exe
        7⤵
        
        PID:8476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44917.exe
        7⤵
        
        PID:12208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7250.exe
        7⤵
        
        PID:15852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60559.exe
        7⤵
        
        PID:7540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17046.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4096.exe
        6⤵
        
        PID:11344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45295.exe
        6⤵
        
        PID:15392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56652.exe
        6⤵
        
        PID:16692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35079.exe
        5⤵
        
        PID:7896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42691.exe
        6⤵
        
        PID:11588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63514.exe
        6⤵
        
        PID:14420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62147.exe
        6⤵
        
        PID:6068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31645.exe
        5⤵
        
        PID:10832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30905.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52186.exe
        5⤵
        
        PID:4212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14733.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14733.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26448.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27136.exe
        6⤵
        
        PID:3108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62528.exe
        7⤵
        
        PID:6428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5010.exe
        8⤵
        
        PID:11296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6905.exe
        8⤵
        
        PID:14924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15246.exe
        8⤵
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43854.exe
        7⤵
        
        PID:10208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3817.exe
        7⤵
        
        PID:13884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33666.exe
        7⤵
        
        PID:16060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24711.exe
        6⤵
        
        PID:7972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60460.exe
        6⤵
        
        PID:11864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26777.exe
        6⤵
        
        PID:15540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51306.exe
        6⤵
        
        PID:16756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42438.exe
        5⤵
        
        PID:2612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18512.exe
        6⤵
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63808.exe
        7⤵
        
        PID:7556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17657.exe
        7⤵
        
        PID:13604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33666.exe
        7⤵
        
        PID:4136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6854.exe
        6⤵
        
        PID:9032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42529.exe
        6⤵
        
        PID:12608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12046.exe
        6⤵
        
        PID:14468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54710.exe
        6⤵
        
        PID:17160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9309.exe
        5⤵
        
        PID:7036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44035.exe
        6⤵
        
        PID:11952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32377.exe
        6⤵
        
        PID:15520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50604.exe
        6⤵
        
        PID:17500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44296.exe
        5⤵
        
        PID:10080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58961.exe
        5⤵
        
        PID:13540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8180.exe
        5⤵
        
        PID:3916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58663.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58663.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31168.exe
        5⤵
        
        PID:3500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52881.exe
        6⤵
        
        PID:6588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56849.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59354.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7250.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43470.exe
        6⤵
        
        PID:10076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23034.exe
        6⤵
        
        PID:13952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58195.exe
        6⤵
        
        PID:4956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21341.exe
        5⤵
        
        PID:6008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60295.exe
        5⤵
        
        PID:10580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47441.exe
        5⤵
        
        PID:15020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8180.exe
        5⤵
        
        PID:18396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13981.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13981.exe
      4⤵
      PID:5196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18816.exe
        5⤵
        
        PID:6956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29635.exe
        6⤵
        
        PID:12484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9570.exe
        6⤵
        
        PID:16700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7830.exe
        5⤵
        
        PID:10608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50241.exe
        5⤵
        
        PID:15076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41859.exe
        5⤵
        
        PID:15892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52167.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52167.exe
      4⤵
      PID:7220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40590.exe
        5⤵
        
        PID:14680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36590.exe
        5⤵
        
        PID:16464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41587.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41587.exe
      4⤵
      PID:10944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43928.exe
      4⤵
      PID:14524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7331.exe
      4⤵
      PID:812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24614.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24614.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17200.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17200.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20864.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63505.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4079.exe
        7⤵
        
        PID:2132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16592.exe
        8⤵
        
        PID:6768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7119.exe
        9⤵
        
        PID:9896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58202.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59347.exe
        9⤵
        
        PID:16620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23543.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6400.exe
        8⤵
        
        PID:13348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47615.exe
        8⤵
        
        PID:16568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23254.exe
        7⤵
        
        PID:7176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42688.exe
        8⤵
        
        PID:10976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5753.exe
        8⤵
        
        PID:15252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16315.exe
        8⤵
        
        PID:1268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49246.exe
        7⤵
        
        PID:10468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61290.exe
        7⤵
        
        PID:2364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33666.exe
        7⤵
        
        PID:3392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4390.exe
        6⤵
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34902.exe
        7⤵
        
        PID:8112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4848.exe
        7⤵
        
        PID:11824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51978.exe
        7⤵
        
        PID:15564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4450.exe
        7⤵
        
        PID:15652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26141.exe
        6⤵
        
        PID:7488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57680.exe
        7⤵
        
        PID:10692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62058.exe
        7⤵
        
        PID:14788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16315.exe
        7⤵
        
        PID:18272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34538.exe
        6⤵
        
        PID:5192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49937.exe
        6⤵
        
        PID:14860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8491.exe
        6⤵
        
        PID:17232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22342.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4079.exe
        6⤵
        
        PID:3484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51345.exe
        7⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42288.exe
        8⤵
        
        PID:8704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37537.exe
        8⤵
        
        PID:12672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17739.exe
        8⤵
        
        PID:17468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22007.exe
        7⤵
        
        PID:9284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6400.exe
        7⤵
        
        PID:13316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58278.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55735.exe
        6⤵
        
        PID:7340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49246.exe
        6⤵
        
        PID:10488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14393.exe
        6⤵
        
        PID:14584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56652.exe
        6⤵
        
        PID:6120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61.exe
        5⤵
        
        PID:5260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27280.exe
        6⤵
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26355.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47178.exe
        7⤵
        
        PID:4088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7650.exe
        7⤵
        
        PID:18352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45498.exe
        6⤵
        
        PID:11116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50241.exe
        6⤵
        
        PID:15052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7650.exe
        6⤵
        
        PID:18372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51960.exe
        5⤵
        
        PID:7376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40293.exe
        6⤵
        
        PID:15436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26448.exe
        5⤵
        
        PID:10480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33401.exe
        5⤵
        
        PID:14712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52186.exe
        5⤵
        
        PID:15648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-998.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-998.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58928.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37712.exe
        6⤵
        
        PID:552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53872.exe
        7⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14799.exe
        8⤵
        
        PID:7112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40709.exe
        8⤵
        
        PID:13636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4450.exe
        8⤵
        
        PID:15564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55583.exe
        8⤵
        
        PID:16508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58167.exe
        7⤵
        
        PID:9132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25040.exe
        7⤵
        
        PID:12712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11662.exe
        7⤵
        
        PID:15676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56652.exe
        7⤵
        
        PID:14768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47271.exe
        6⤵
        
        PID:7140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51696.exe
        7⤵
        
        PID:8660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37537.exe
        7⤵
        
        PID:13168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42332.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63070.exe
        6⤵
        
        PID:9360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49925.exe
        6⤵
        
        PID:11964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56652.exe
        6⤵
        
        PID:4352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19766.exe
        5⤵
        
        PID:5148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56311.exe
        6⤵
        
        PID:7232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15511.exe
        7⤵
        
        PID:16540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21534.exe
        6⤵
        
        PID:10524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35333.exe
        6⤵
        
        PID:3880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22805.exe
        6⤵
        
        PID:16768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53326.exe
        5⤵
        
        PID:7224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23648.exe
        6⤵
        
        PID:9960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58202.exe
        6⤵
        
        PID:12880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58963.exe
        6⤵
        
        PID:16920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6870.exe
        5⤵
        
        PID:10328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13216.exe
        5⤵
        
        PID:13916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8180.exe
        5⤵
        
        PID:18424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3021.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53472.exe
        5⤵
        
        PID:5128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16592.exe
        6⤵
        
        PID:6776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7311.exe
        7⤵
        
        PID:9976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32539.exe
        7⤵
        
        PID:14532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65212.exe
        7⤵
        
        PID:17004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9346.exe
        7⤵
        
        PID:6832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51447.exe
        6⤵
        
        PID:9512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54325.exe
        7⤵
        
        PID:14472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61068.exe
        7⤵
        
        PID:5488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6400.exe
        6⤵
        
        PID:13732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-526.exe
        6⤵
        
        PID:17416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35319.exe
        5⤵
        
        PID:5164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3071.exe
        6⤵
        
        PID:8736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28793.exe
        6⤵
        
        PID:12596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7634.exe
        6⤵
        
        PID:15432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7650.exe
        6⤵
        
        PID:18388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49335.exe
        5⤵
        
        PID:9940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14368.exe
        5⤵
        
        PID:13960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7111.exe
        5⤵
        
        PID:5832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17078.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17078.exe
      4⤵
      PID:6096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31328.exe
        5⤵
        
        PID:7636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32825.exe
        5⤵
        
        PID:12280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5760.exe
        5⤵
        
        PID:16032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15502.exe
        5⤵
        
        PID:1820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63902.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63902.exe
      4⤵
      PID:8128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38553.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38553.exe
      4⤵
      PID:12064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11938.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11938.exe
      4⤵
      PID:15760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48602.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48602.exe
      4⤵
      PID:15584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15646.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15646.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35280.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35280.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49888.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35776.exe
        6⤵
        Executes dropped EXE
        
        PID:1904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9087.exe
        7⤵
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14991.exe
        8⤵
        
        PID:7456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17065.exe
        8⤵
        
        PID:11176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48367.exe
        8⤵
        
        PID:2900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65287.exe
        7⤵
        
        PID:8556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29561.exe
        7⤵
        
        PID:14752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52186.exe
        7⤵
        
        PID:4504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51687.exe
        6⤵
        
        PID:5372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3071.exe
        7⤵
        
        PID:8756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28793.exe
        7⤵
        
        PID:12620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7634.exe
        7⤵
        
        PID:12204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46847.exe
        7⤵
        
        PID:16556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6557.exe
        6⤵
        
        PID:9172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30906.exe
        6⤵
        
        PID:12804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21646.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34934.exe
        5⤵
        
        PID:4164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9087.exe
        6⤵
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3071.exe
        7⤵
        
        PID:8604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10153.exe
        7⤵
        
        PID:12492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7250.exe
        7⤵
        
        PID:15720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45774.exe
        6⤵
        
        PID:8976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12265.exe
        6⤵
        
        PID:13152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56652.exe
        6⤵
        
        PID:5340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49086.exe
        5⤵
        
        PID:1100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18256.exe
        6⤵
        
        PID:8288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34169.exe
        6⤵
        
        PID:11972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4645.exe
        6⤵
        
        PID:14344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4733.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19161.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4980.exe
        5⤵
        
        PID:2396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36182.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36182.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21936.exe
        5⤵
        
        PID:4420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9087.exe
        6⤵
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51696.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37049.exe
        7⤵
        
        PID:12252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58179.exe
        7⤵
        
        PID:16144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29437.exe
        6⤵
        
        PID:8960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23418.exe
        6⤵
        
        PID:2680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34242.exe
        6⤵
        
        PID:15464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51687.exe
        5⤵
        
        PID:5368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23648.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58202.exe
        6⤵
        
        PID:12768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36467.exe
        6⤵
        
        PID:16528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62686.exe
        5⤵
        
        PID:1772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12265.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23874.exe
        5⤵
        
        PID:15572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48286.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48286.exe
      4⤵
      PID:1788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56752.exe
        5⤵
        
        PID:6308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42688.exe
        6⤵
        
        PID:11000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5753.exe
        6⤵
        
        PID:15196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16315.exe
        6⤵
        
        PID:2336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43854.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3817.exe
        5⤵
        
        PID:13900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37781.exe
        5⤵
        
        PID:16136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41127.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41127.exe
      4⤵
      PID:6652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46446.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46446.exe
      4⤵
      PID:10496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10132.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10132.exe
      4⤵
      PID:11408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52186.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52186.exe
      4⤵
      PID:18416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51159.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51159.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10111.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10111.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46544.exe
        5⤵
        
        PID:4344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40416.exe
        6⤵
        
        PID:6320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58448.exe
        7⤵
        
        PID:11160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5753.exe
        7⤵
        
        PID:15268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58963.exe
        7⤵
        
        PID:16928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43854.exe
        6⤵
        
        PID:10152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43781.exe
        6⤵
        
        PID:13868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4450.exe
        6⤵
        
        PID:15888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41659.exe
        6⤵
        
        PID:3856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21526.exe
        5⤵
        
        PID:6900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40960.exe
        6⤵
        
        PID:10796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61674.exe
        6⤵
        
        PID:14796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2475.exe
        6⤵
        
        PID:5436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8301.exe
        5⤵
        
        PID:9708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3241.exe
        5⤵
        
        PID:13688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56652.exe
        5⤵
        
        PID:5424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61655.exe
      4⤵
      PID:1628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39590.exe
        5⤵
        
        PID:7248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42880.exe
        6⤵
        
        PID:11076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55146.exe
        6⤵
        
        PID:15124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16315.exe
        6⤵
        
        PID:5300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16765.exe
        5⤵
        
        PID:10380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5545.exe
        5⤵
        
        PID:9100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56652.exe
        5⤵
        
        PID:16668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3933.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3933.exe
      4⤵
      PID:7332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32880.exe
        5⤵
        
        PID:10060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32073.exe
        5⤵
        
        PID:13816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59347.exe
        5⤵
        
        PID:16632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22631.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22631.exe
      4⤵
      PID:10428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19568.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19568.exe
      4⤵
      PID:3440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8180.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8180.exe
      4⤵
      PID:18404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-797.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-797.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47888.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47888.exe
      4⤵
      PID:1672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47152.exe
        5⤵
        
        PID:6716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40960.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61674.exe
        6⤵
        
        PID:14780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16315.exe
        6⤵
        
        PID:18312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18390.exe
        5⤵
        
        PID:9456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6400.exe
        5⤵
        
        PID:13988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-427.exe
        5⤵
        
        PID:1448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64014.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64014.exe
      4⤵
      PID:7660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42426.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42426.exe
      4⤵
      PID:11528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25056.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25056.exe
      4⤵
      PID:15604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53452.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53452.exe
      4⤵
      PID:4852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58725.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58725.exe
      4⤵
      PID:1076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48374.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48374.exe
    3⤵
    PID:5380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31968.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31968.exe
      4⤵
      PID:7128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20579.exe
        5⤵
        
        PID:11360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36212.exe
        5⤵
        
        PID:232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16315.exe
        5⤵
        
        PID:18264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34534.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34534.exe
      4⤵
      PID:9640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6400.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6400.exe
      4⤵
      PID:13364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42332.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42332.exe
      4⤵
      PID:16440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43280.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43280.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12565.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12565.exe
    3⤵
    PID:11120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55889.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55889.exe
    3⤵
    PID:15288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35262.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35262.exe
    3⤵
    PID:17296
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62328.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62328.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44480.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44480.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47376.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12342.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32704.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10031.exe
        7⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23056.exe
        8⤵
        
        PID:8084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42617.exe
        8⤵
        
        PID:11896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46113.exe
        8⤵
        
        PID:15576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56652.exe
        8⤵
        
        PID:5664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-886.exe
        7⤵
        
        PID:7800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36561.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33722.exe
        7⤵
        
        PID:15412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4450.exe
        7⤵
        
        PID:15672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41659.exe
        7⤵
        
        PID:6108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40342.exe
        6⤵
        
        PID:5516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47472.exe
        7⤵
        
        PID:7368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17065.exe
        7⤵
        
        PID:12172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52849.exe
        7⤵
        
        PID:15988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49052.exe
        7⤵
        
        PID:2676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43262.exe
        6⤵
        
        PID:7920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37434.exe
        6⤵
        
        PID:11600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37006.exe
        6⤵
        
        PID:16288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10429.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57696.exe
        6⤵
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15439.exe
        7⤵
        
        PID:7048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46720.exe
        8⤵
        
        PID:9984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32073.exe
        8⤵
        
        PID:13808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39430.exe
        8⤵
        
        PID:15404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63375.exe
        8⤵
        
        PID:17152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52407.exe
        7⤵
        
        PID:10024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38497.exe
        7⤵
        
        PID:13468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64828.exe
        7⤵
        
        PID:16888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62239.exe
        6⤵
        
        PID:7400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12930.exe
        7⤵
        
        PID:14612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52140.exe
        7⤵
        
        PID:16548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35114.exe
        6⤵
        
        PID:9588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17840.exe
        6⤵
        
        PID:14444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39627.exe
        6⤵
        
        PID:16764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42071.exe
        5⤵
        
        PID:868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64000.exe
        6⤵
        
        PID:7620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16297.exe
        6⤵
        
        PID:11084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52849.exe
        6⤵
        
        PID:15920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33100.exe
        6⤵
        
        PID:16316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65438.exe
        5⤵
        
        PID:6984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11465.exe
        5⤵
        
        PID:12156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34243.exe
        5⤵
        
        PID:15908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52442.exe
        5⤵
        
        PID:5056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52856.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52856.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59504.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11183.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10815.exe
        7⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9023.exe
        8⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44154.exe
        8⤵
        
        PID:12056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12046.exe
        8⤵
        
        PID:15552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56652.exe
        8⤵
        
        PID:16672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62583.exe
        7⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31568.exe
        7⤵
        
        PID:11808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43722.exe
        7⤵
        
        PID:16064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23682.exe
        7⤵
        
        PID:17440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51687.exe
        6⤵
        
        PID:4824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3071.exe
        7⤵
        
        PID:8692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34565.exe
        7⤵
        
        PID:13548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3381.exe
        7⤵
        
        PID:15444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35358.exe
        7⤵
        
        PID:6216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62686.exe
        6⤵
        
        PID:5672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49925.exe
        6⤵
        
        PID:2172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56652.exe
        6⤵
        
        PID:15420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23798.exe
        5⤵
        
        PID:4712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62865.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51696.exe
        7⤵
        
        PID:8684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37537.exe
        7⤵
        
        PID:13180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7650.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62583.exe
        6⤵
        
        PID:6456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46177.exe
        6⤵
        
        PID:11308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48901.exe
        6⤵
        
        PID:15972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7906.exe
        6⤵
        
        PID:14836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2603.exe
        6⤵
        
        PID:4796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53663.exe
        5⤵
        
        PID:5856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47472.exe
        6⤵
        
        PID:7348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11584.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56364.exe
        6⤵
        
        PID:15776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12422.exe
        5⤵
        
        PID:9188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22240.exe
        5⤵
        
        PID:12732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6363.exe
        5⤵
        
        PID:16044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20509.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20509.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45968.exe
        5⤵
        
        PID:4380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54064.exe
        6⤵
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51312.exe
        7⤵
        
        PID:8196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12352.exe
        7⤵
        
        PID:13236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55980.exe
        7⤵
        
        PID:4836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58167.exe
        6⤵
        
        PID:9140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25040.exe
        6⤵
        
        PID:12720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62207.exe
        6⤵
        
        PID:3188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2802.exe
        6⤵
        
        PID:7428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14790.exe
        5⤵
        
        PID:7164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56320.exe
        6⤵
        
        PID:10168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24761.exe
        6⤵
        
        PID:14020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16315.exe
        6⤵
        
        PID:18336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38431.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44362.exe
        5⤵
        
        PID:14180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53542.exe
        5⤵
        
        PID:16032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51804.exe
        5⤵
        
        PID:2292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46279.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46279.exe
      4⤵
      PID:4776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20934.exe
        5⤵
        
        PID:6296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42288.exe
        6⤵
        
        PID:8712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61850.exe
        6⤵
        
        PID:12540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6181.exe
        6⤵
        
        PID:15524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-738.exe
        6⤵
        
        PID:1240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35743.exe
        5⤵
        
        PID:9268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12265.exe
        5⤵
        
        PID:13324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4450.exe
        5⤵
        
        PID:15748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62046.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62046.exe
      4⤵
      PID:6168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2495.exe
        5⤵
        
        PID:8620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6167.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37537.exe
        5⤵
        
        PID:13208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31580.exe
        5⤵
        
        PID:17488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16407.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16407.exe
      4⤵
      PID:9256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4130.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4130.exe
      4⤵
      PID:12948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12666.exe
      4⤵
      PID:15828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15491.exe
      4⤵
      PID:8876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43847.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43847.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3375.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3375.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33360.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35968.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1910.exe
        7⤵
        
        PID:6192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42288.exe
        8⤵
        
        PID:8728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11305.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7634.exe
        8⤵
        
        PID:15728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6173.exe
        7⤵
        
        PID:6188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30906.exe
        7⤵
        
        PID:12812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3381.exe
        7⤵
        
        PID:16008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39927.exe
        6⤵
        
        PID:6148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60352.exe
        7⤵
        
        PID:8540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3817.exe
        7⤵
        
        PID:12536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37043.exe
        7⤵
        
        PID:2380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49719.exe
        6⤵
        
        PID:10128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60689.exe
        6⤵
        
        PID:13892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56156.exe
        6⤵
        
        PID:17532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6647.exe
        5⤵
        
        PID:4436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9087.exe
        6⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56849.exe
        7⤵
        
        PID:8676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37537.exe
        7⤵
        
        PID:11704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15246.exe
        7⤵
        
        PID:15456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65287.exe
        6⤵
        
        PID:8840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29561.exe
        6⤵
        
        PID:14744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43354.exe
        6⤵
        
        PID:18292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65422.exe
        5⤵
        
        PID:1340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63616.exe
        6⤵
        
        PID:6744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32441.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33100.exe
        6⤵
        
        PID:16304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19138.exe
        6⤵
        
        PID:7244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11078.exe
        5⤵
        
        PID:8344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18734.exe
        5⤵
        
        PID:10536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10132.exe
        5⤵
        
        PID:12516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34197.exe
        5⤵
        
        PID:1224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52327.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52327.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37696.exe
        5⤵
        
        PID:3936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41952.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52625.exe
        7⤵
        
        PID:7580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32825.exe
        7⤵
        
        PID:12264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64127.exe
        7⤵
        
        PID:3568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29526.exe
        6⤵
        
        PID:7968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6551.exe
        7⤵
        
        PID:1676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18217.exe
        6⤵
        
        PID:13228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47315.exe
        6⤵
        
        PID:2760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19014.exe
        5⤵
        
        PID:2460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11727.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64346.exe
        6⤵
        
        PID:13136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2770.exe
        6⤵
        
        PID:18360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6557.exe
        5⤵
        
        PID:9180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30906.exe
        5⤵
        
        PID:12748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3381.exe
        5⤵
        
        PID:15580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38174.exe
        5⤵
        
        PID:17036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15421.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15421.exe
      4⤵
      PID:220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58288.exe
        5⤵
        
        PID:5824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56849.exe
        6⤵
        
        PID:8588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16581.exe
        7⤵
        
        PID:16972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10153.exe
        6⤵
        
        PID:12408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7250.exe
        6⤵
        
        PID:15828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51071.exe
        6⤵
        
        PID:17200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29437.exe
        5⤵
        
        PID:9444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12265.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33666.exe
        5⤵
        
        PID:4604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54951.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54951.exe
      4⤵
      PID:5220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3071.exe
        5⤵
        
        PID:8496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10729.exe
        5⤵
        
        PID:12192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7250.exe
        5⤵
        
        PID:15844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60559.exe
        5⤵
        
        PID:7724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40623.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40623.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38761.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38761.exe
      4⤵
      PID:12756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36776.exe
      4⤵
      PID:15464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33709.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33709.exe
      4⤵
      PID:17064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62206.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62206.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49888.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49888.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35968.exe
        5⤵
        Executes dropped EXE
        
        PID:4368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4671.exe
        6⤵
        
        PID:5336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33632.exe
        7⤵
        
        PID:8136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17833.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37857.exe
        7⤵
        
        PID:16084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41839.exe
        7⤵
        
        PID:4896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58167.exe
        6⤵
        
        PID:9124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25040.exe
        6⤵
        
        PID:12704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47900.exe
        6⤵
        
        PID:16024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18453.exe
        6⤵
        
        PID:6212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63991.exe
        5⤵
        
        PID:7152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31728.exe
        6⤵
        
        PID:9624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17465.exe
        6⤵
        
        PID:13840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60995.exe
        6⤵
        
        PID:16256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40014.exe
        5⤵
        
        PID:10132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44362.exe
        5⤵
        
        PID:13440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4450.exe
        5⤵
        
        PID:13900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2454.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2454.exe
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63664.exe
        5⤵
        
        PID:5920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18128.exe
        6⤵
        
        PID:7104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39792.exe
        7⤵
        
        PID:9912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58202.exe
        7⤵
        
        PID:12960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8402.exe
        7⤵
        
        PID:16328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27804.exe
        7⤵
        
        PID:5988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24695.exe
        6⤵
        
        PID:10068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29194.exe
        6⤵
        
        PID:13564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8690.exe
        6⤵
        
        PID:17304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64014.exe
        5⤵
        
        PID:7652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42426.exe
        5⤵
        
        PID:11536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25056.exe
        5⤵
        
        PID:4440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53452.exe
        5⤵
        
        PID:15700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58725.exe
        5⤵
        
        PID:16492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53694.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53694.exe
      4⤵
      PID:5776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52625.exe
        5⤵
        
        PID:1936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41155.exe
        6⤵
        
        PID:12152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44444.exe
        6⤵
        
        PID:15912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17657.exe
        5⤵
        
        PID:13612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56652.exe
        5⤵
        
        PID:17048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16646.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16646.exe
      4⤵
      PID:6656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28768.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28768.exe
      4⤵
      PID:11656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38805.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38805.exe
      4⤵
      PID:3216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39255.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39255.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37696.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37696.exe
      4⤵
      PID:1564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9087.exe
        5⤵
        
        PID:5728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3071.exe
        6⤵
        
        PID:8636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36961.exe
        6⤵
        
        PID:13260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40323.exe
        6⤵
        
        PID:1668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31062.exe
        5⤵
        
        PID:8272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-240.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55583.exe
        5⤵
        
        PID:5840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3174.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3174.exe
      4⤵
      PID:8000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26352.exe
        5⤵
        
        PID:11016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5753.exe
        5⤵
        
        PID:15236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58963.exe
        5⤵
        
        PID:16936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33565.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33565.exe
      4⤵
      PID:10244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17641.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17641.exe
      4⤵
      PID:14432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52186.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52186.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12621.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12621.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9087.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9087.exe
      4⤵
      PID:5848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3055.exe
        5⤵
        
        PID:7032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8022.exe
        5⤵
        
        PID:10288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50241.exe
        5⤵
        
        PID:15060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1323.exe
        5⤵
        
        PID:16452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-886.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-886.exe
      4⤵
      PID:7824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36561.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36561.exe
      4⤵
      PID:11544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33722.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33722.exe
      4⤵
      PID:14948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4450.exe
      4⤵
      PID:15764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36427.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36427.exe
      4⤵
      PID:7872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46086.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46086.exe
    3⤵
    PID:5376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42288.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42288.exe
      4⤵
      PID:8720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22160.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22160.exe
      4⤵
      PID:13508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65212.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65212.exe
      4⤵
      PID:16644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38304.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38304.exe
    3⤵
    PID:8568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46984.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46984.exe
    3⤵
    PID:12764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31859.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31859.exe
    3⤵
    PID:17292
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5869.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5869.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-863.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-863.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20864.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20864.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42976.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45392.exe
        6⤵
        
        PID:628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25040.exe
        7⤵
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64384.exe
        8⤵
        
        PID:7392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43681.exe
        8⤵
        
        PID:12968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31471.exe
        8⤵
        
        PID:17092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65287.exe
        7⤵
        
        PID:9332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43009.exe
        7⤵
        
        PID:13800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17131.exe
        7⤵
        
        PID:876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51687.exe
        6⤵
        
        PID:5252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18640.exe
        7⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15511.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5337.exe
        7⤵
        
        PID:12052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15435.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40574.exe
        6⤵
        
        PID:8560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58202.exe
        6⤵
        
        PID:12848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-994.exe
        6⤵
        
        PID:1412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26678.exe
        5⤵
        
        PID:1880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46192.exe
        6⤵
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11727.exe
        7⤵
        
        PID:7432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64346.exe
        7⤵
        
        PID:13128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60995.exe
        7⤵
        
        PID:14668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43854.exe
        6⤵
        
        PID:9304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48017.exe
        6⤵
        
        PID:14928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8180.exe
        6⤵
        
        PID:5280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36990.exe
        5⤵
        
        PID:7184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5967.exe
        6⤵
        
        PID:9392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58202.exe
        6⤵
        
        PID:12604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16315.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12246.exe
        5⤵
        
        PID:9012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32427.exe
        5⤵
        
        PID:13580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22414.exe
        5⤵
        
        PID:16604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55399.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55399.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6191.exe
        5⤵
        
        PID:5268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16592.exe
        6⤵
        
        PID:6916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51696.exe
        7⤵
        
        PID:8652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10153.exe
        7⤵
        
        PID:12388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7250.exe
        7⤵
        
        PID:13708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60559.exe
        7⤵
        
        PID:16516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21623.exe
        6⤵
        
        PID:9376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4096.exe
        6⤵
        
        PID:12128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33391.exe
        6⤵
        
        PID:17456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21526.exe
        5⤵
        
        PID:6688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41920.exe
        6⤵
        
        PID:11180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19785.exe
        6⤵
        
        PID:15136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59926.exe
        6⤵
        
        PID:16592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32008.exe
        5⤵
        
        PID:10848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47441.exe
        5⤵
        
        PID:14976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41659.exe
        5⤵
        
        PID:16300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61566.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61566.exe
      4⤵
      PID:6052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14991.exe
        5⤵
        
        PID:7596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32825.exe
        5⤵
        
        PID:12272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5760.exe
        5⤵
        
        PID:16048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41839.exe
        5⤵
        
        PID:16160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26055.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26055.exe
      4⤵
      PID:5768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28000.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28000.exe
      4⤵
      PID:12196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22276.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22276.exe
      4⤵
      PID:16212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11661.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11661.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36736.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36736.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9087.exe
        5⤵
        
        PID:5708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9023.exe
        6⤵
        
        PID:6228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40709.exe
        6⤵
        
        PID:13644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23874.exe
        6⤵
        
        PID:16064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65287.exe
        5⤵
        
        PID:8860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29561.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52186.exe
        5⤵
        
        PID:2940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33725.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33725.exe
      4⤵
      PID:6552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61136.exe
        5⤵
        
        PID:11216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36505.exe
        5⤵
        
        PID:15040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16315.exe
        5⤵
        
        PID:5292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45879.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45879.exe
      4⤵
      PID:10144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35696.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35696.exe
      4⤵
      PID:13428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9067.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9067.exe
      4⤵
      PID:18160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36087.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36087.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24256.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24256.exe
      4⤵
      PID:5508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48880.exe
        5⤵
        
        PID:6872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42480.exe
        6⤵
        
        PID:9056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28793.exe
        6⤵
        
        PID:12628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6181.exe
        6⤵
        
        PID:15508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64355.exe
        6⤵
        
        PID:18304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51447.exe
        5⤵
        
        PID:9528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6400.exe
        5⤵
        
        PID:13340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42332.exe
        5⤵
        
        PID:16396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56503.exe
      4⤵
      PID:7612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48654.exe
        5⤵
        
        PID:3588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29550.exe
        5⤵
        
        PID:17104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49246.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49246.exe
      4⤵
      PID:10460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61482.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61482.exe
      4⤵
      PID:13836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33666.exe
      4⤵
      PID:16312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24749.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24749.exe
    3⤵
    PID:5960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5935.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5935.exe
      4⤵
      PID:6240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28883.exe
        5⤵
        
        PID:13420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45228.exe
        5⤵
        
        PID:16804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40310.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40310.exe
      4⤵
      PID:10948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33520.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33520.exe
      4⤵
      PID:15148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42332.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42332.exe
      4⤵
      PID:16404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60823.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60823.exe
    3⤵
    PID:7880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17186.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17186.exe
    3⤵
    PID:11620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37112.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37112.exe
    3⤵
    PID:15468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36059.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36059.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:864
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49223.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49223.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7184.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7184.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26256.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26256.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20416.exe
        5⤵
        
        PID:468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64640.exe
        6⤵
        
        PID:7096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42880.exe
        7⤵
        
        PID:11048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5753.exe
        7⤵
        
        PID:15260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60995.exe
        7⤵
        
        PID:16156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52407.exe
        6⤵
        
        PID:10016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29194.exe
        6⤵
        
        PID:13384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13298.exe
        6⤵
        
        PID:15608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7494.exe
        5⤵
        
        PID:7700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35187.exe
        6⤵
        
        PID:10604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39001.exe
        6⤵
        
        PID:14456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7483.exe
        6⤵
        
        PID:18260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42810.exe
        5⤵
        
        PID:11444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25248.exe
        5⤵
        
        PID:14468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53452.exe
        5⤵
        
        PID:15212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-500.exe
        5⤵
        
        PID:15948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47831.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47831.exe
      4⤵
      PID:6032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48880.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33025.exe
        6⤵
        
        PID:8520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39156.exe
        6⤵
        
        PID:13072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17634.exe
        6⤵
        
        PID:15460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51447.exe
        5⤵
        
        PID:9520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6400.exe
        5⤵
        
        PID:13068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6581.exe
        5⤵
        
        PID:1372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4893.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4893.exe
      4⤵
      PID:7668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26352.exe
        5⤵
        
        PID:10964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5753.exe
        5⤵
        
        PID:15340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16315.exe
        5⤵
        
        PID:5312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25127.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25127.exe
      4⤵
      PID:10684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23792.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23792.exe
      4⤵
      PID:14704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15403.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15403.exe
      4⤵
      PID:15552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6006.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6006.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20992.exe
      4⤵
      PID:4428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46960.exe
        5⤵
        
        PID:6676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65152.exe
        6⤵
        
        PID:7792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12352.exe
        6⤵
        
        PID:13248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25420.exe
        6⤵
        
        PID:4088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48951.exe
        5⤵
        
        PID:8764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61169.exe
        5⤵
        
        PID:11872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22348.exe
        5⤵
        
        PID:16096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63223.exe
      4⤵
      PID:6468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43278.exe
      4⤵
      PID:10164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51674.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51674.exe
      4⤵
      PID:13792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22805.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22805.exe
      4⤵
      PID:16988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2173.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2173.exe
    3⤵
    PID:5408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23056.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23056.exe
      4⤵
      PID:8016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45560.exe
        5⤵
        
        PID:15984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42617.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42617.exe
      4⤵
      PID:11904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6770.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6770.exe
      4⤵
      PID:16732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32007.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32007.exe
    3⤵
    PID:7508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41720.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41720.exe
      4⤵
      PID:376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61425.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61425.exe
    3⤵
    PID:3552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1305.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1305.exe
    3⤵
    PID:14916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56693.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56693.exe
    3⤵
    PID:16856
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9629.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9629.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10111.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10111.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21568.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21568.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16592.exe
        5⤵
        
        PID:6908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18256.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44917.exe
        6⤵
        
        PID:10992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7250.exe
        6⤵
        
        PID:15800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51071.exe
        6⤵
        
        PID:17184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20855.exe
        5⤵
        
        PID:8832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6400.exe
        5⤵
        
        PID:13980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32156.exe
        5⤵
        
        PID:16576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22301.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22301.exe
      4⤵
      PID:7276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33386.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33386.exe
      4⤵
      PID:10988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64929.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64929.exe
      4⤵
      PID:14396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39627.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39627.exe
      4⤵
      PID:16820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53975.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53975.exe
    3⤵
    PID:5396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48880.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48880.exe
      4⤵
      PID:6880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18832.exe
        5⤵
        
        PID:8212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34553.exe
        5⤵
        
        PID:11788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37857.exe
        5⤵
        
        PID:16092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41839.exe
        5⤵
        
        PID:17324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65479.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65479.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6400.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6400.exe
      4⤵
      PID:13356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65212.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65212.exe
      4⤵
      PID:16656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61886.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61886.exe
    3⤵
    PID:8088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16581.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16581.exe
      4⤵
      PID:16504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42231.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42231.exe
    3⤵
    PID:11136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16688.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16688.exe
    3⤵
    PID:15304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8180.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8180.exe
    3⤵
    PID:18380
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49798.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49798.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31360.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31360.exe
    3⤵
    PID:4608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55953.exe
      4⤵
      PID:7116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40960.exe
        5⤵
        
        PID:10780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61674.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16315.exe
        5⤵
        
        PID:18328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24695.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24695.exe
      4⤵
      PID:10104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29194.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29194.exe
      4⤵
      PID:14408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33666.exe
      4⤵
      PID:2468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31814.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31814.exe
    3⤵
    PID:7912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46723.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46723.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59030.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59030.exe
      4⤵
      PID:3372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34445.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34445.exe
    3⤵
    PID:10856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54378.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54378.exe
    3⤵
    PID:14816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23874.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23874.exe
    3⤵
    PID:15484
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14511.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14511.exe
  2⤵
  PID:5184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16592.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16592.exe
    3⤵
    PID:6760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2495.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2495.exe
      4⤵
      PID:8668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10153.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10153.exe
      4⤵
      PID:12380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15435.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15435.exe
      4⤵
      PID:16724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-710.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-710.exe
    3⤵
    PID:9308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44060.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44060.exe
    3⤵
    PID:12136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12046.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12046.exe
    3⤵
    PID:14360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38856.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38856.exe
    3⤵
    PID:17708
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44325.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44325.exe
  2⤵
  PID:6748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23648.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23648.exe
    3⤵
    PID:9944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24761.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24761.exe
    3⤵
    PID:13480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7250.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7250.exe
    3⤵
    PID:13680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31388.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31388.exe
    3⤵
    PID:16980
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53166.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53166.exe
  2⤵
  PID:10372
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56618.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56618.exe
  2⤵
  PID:13280
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19047.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19047.exe
  2⤵
  PID:15516
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52175.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52175.exe
  2⤵
  PID:17508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1260 -ip 1260
1⤵
PID:5432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 13900 -ip 13900
1⤵
PID:15700

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2992

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:5928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11661.exe

Filesize
468KB

MD5
206315eb0720842a2411cd1a9839769f

SHA1
ee4fb643fa0d5cffc939523ab9c8afc62f89f5a3

SHA256
5ca1801392e6a558156f9d5e718ac3c0231e9ea46f6d6accc22d5c32e3eab345

SHA512
28bd0729ca458cf8e5ddfbf106069bca8dc099c2b0acc6c1e2993f2ce8ee1706c443cc75ff39db5d4d1f6694d8a89d8d24b01d7c7ab8bc3edd6fadd5e5c1c520

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12342.exe

Filesize
468KB

MD5
406195110e12372f22f4c8ff408cfff6

SHA1
fc7562fd2594285d366dcbd50171dbebb4c3e0ac

SHA256
5a8b131b9be43aff0ae6d0183314d019a051c911d0794f962e9a8ed9c6463476

SHA512
6e6922ac7bc5dc582530eed0b7b001e99914c021bfcc14c46d0af947537197cc002677d49c39061aa51076df910d0fbde65ce2678981bb27c14f930de8a94063

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14733.exe

Filesize
468KB

MD5
6422f58c36f832199d86d6ef44fc5084

SHA1
f47fe5405a7df9a64795239a862645e9598ee1f4

SHA256
f2e43a335c101b20509dbec1c1a76634f34228376d24cf6cddab2eef0c344465

SHA512
b6d8fc38cd76345aa89faa761a825239aa8d784899633e9879be3e873a18ade691f5a472e49d19dd7673fb6da8b02b321ad0c0168205f4adc063958fbd2052b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15646.exe

Filesize
468KB

MD5
3e8214607f35aea2064c17650cb843c7

SHA1
2b08dcb819daed9d2ecc38cce25002d3df6791a4

SHA256
51f9656ef6746a98e0b9040d6cba55cf8ebda896baf730e53e288f9b0f661eaf

SHA512
11bc017773afc02abfd3b90d7109cda15569ef6e66cbff4e05d4b0aeca949fb9fb83687de81d9ad2ad5ed7363839074015b51e55cc6913e268ed2bbf685aad25

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17200.exe

Filesize
468KB

MD5
de526d704c7112cb3c4e041a8bea443b

SHA1
d3a4ebad7d04f06fbea723f4f807493f735b1b12

SHA256
4a0a0b9effde0ecf5b2181afb73cf65bab28c9fab3abc222563e922ef01ddf5f

SHA512
ec824ff88fe528da2f987986db122a72a3cd97f1be09d7737cb744db10530eeedf68a3c27d47ce1cbb0e9c4ef968a77557e21e16f4d411dc3f150e1520f170e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20864.exe

Filesize
468KB

MD5
f59ebe24d989cd836cb42551e1cac318

SHA1
3c893801ae751f3f0f34fef0b1ba68772bc01fb9

SHA256
eb84ced34b841bf8d3cf1a9cac95b0d477ec86047f07e309e83de6f5fbc101a6

SHA512
99f6007070dd50f579c6184e225ff7a42e8e71bc6a5113e20339445a8e6e6f6ff212a8774e217ef3aab9a953d8ae139ff768036e53a77ee1dd9f7b0f616366f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24614.exe

Filesize
468KB

MD5
e5683ae1b5b7d5a7f486c17fd18c1293

SHA1
8f64bce9309cbe1f50d4fdc9e08a5c920eb9dd38

SHA256
6fecfcdce27d7964f0f7bf376326a26bedf77fb8080bee1bb29aa541f5ddcac2

SHA512
c2fa89e6a3ceaa09358024c6fd71c348852f0859525212c5291cebc8aed6a909fd1ee3751ba2f0d6683c7e82a3f0d087a5575cc58b23efae066b87487054c095

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26544.exe

Filesize
468KB

MD5
601db5abae723293c23d516288c3f95e

SHA1
f6a0ae7896d08834b9183c243b8b122b42c76a1d

SHA256
17d6bd21963c6195798d7cada1f0730015efae9b58665b8bb542fee32756da4b

SHA512
6df0903cd007890df2132d5b6936a89c2bad1f0a8e4fd22b5f1815b5e134ab3f327d2fdd9198dc1ef9f0d7772922265d3838e0f226c1cbd228e8df84319440a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30198.exe

Filesize
468KB

MD5
df4267cfebdf426116c48a98edab2b1b

SHA1
d438d79adbc580ac66748519abdda5b40a92b9f2

SHA256
06dcf64a8c31e0786d0bd90785122049818b4ac73d1bb5829577eee06c753526

SHA512
bb1d47269abbb5d74f6e0798fda0fe7a8daec0b278953242205568ee85b79f7ae5e2fdaa6344642ec39921cf0a7e05bd7d18b46e548091e757588f36692f233d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33344.exe

Filesize
468KB

MD5
c7fd3e7f076a56f81cf942e7db75d645

SHA1
3fb939be3103ea21d055c64687e88131d25d5de7

SHA256
80d0887a941b70cfef7cd22d035b3fb2897706e05662777b2c3a10ad3425928b

SHA512
8ddc96acec99d29523026a9878111a4f07f2b05395a4273a3b6be281d91a1bb3a4b43cc385ddf24e51f9f62b6ee944734c1388044fb4e45a052510aab6be2fef

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33360.exe

Filesize
468KB

MD5
f228153f0ea7481b0d0fc65703dbab57

SHA1
f055f6e8f84fe99f7ad0e6caff8cf80cddb8623c

SHA256
10060777066d76b75617cfb391dbb2dee602d056084bc81a14584b56eecec2e1

SHA512
f58ea6aecf0b6b42879f4dc90845122e983aa340a18296c6cc2b4066806337cd6902333156bb6154042c7e016223d52d290fc26bf8bdffdd919f318558c23378

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3375.exe

Filesize
468KB

MD5
8abeaa581a9ad38a5e52aec15ec99364

SHA1
d2278478b1efcb11ce39d9b23be7c22948134e09

SHA256
d7cf3ab2a6d74c3f875f9dcde13d6d1e1908ba286e740b4a759e7bf9c50eb233

SHA512
5bdc5b2cf1b9a47c1c6a2a7234ead408c15d88c11571d8831192827919eed3d594d21a06c68edc937839285be9181f52e100aeb04a501d88ad10796f9af2621c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35280.exe

Filesize
468KB

MD5
05af03230221350e826927296375a38e

SHA1
d89a83298b24ef8ab60eb3fe3fc99ab54eb83457

SHA256
7c8df1a18ec91decad44ebde4051fd1b8817ad4ae065499aceab1809093f23c9

SHA512
01fbb217ce347afa6f59c596894ed3cc990ce6003843c45650903898d30d1a7918e15a2c793f0f1396b5b94a214d20d91ea597218e8139b4a21cc5d1f24f0768

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36736.exe

Filesize
468KB

MD5
7291b9e6a13e55055ca975da99a2ade3

SHA1
aa6958a5ff215fd4ccc38c2ed45f1cada0849782

SHA256
3e4ca0c777f468b96f2300130312536cea9f67d95c5158f21efa367aa52e887b

SHA512
07a524cc1ee75a20becc609c11a74d91ecc24d8c45e55d5a2c66aa9976b00a2e76f76ce9fd3a0008f7d7aa342d21ceb82a572f53f931d8dae6c0325c7867766d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3817.exe

Filesize
468KB

MD5
944a16675f57fa2551a9068c5b91573b

SHA1
e5cc9b71af31bbf4b0d309313739ede2f321e934

SHA256
0b75e1f6937f0b6fa2bc793d5624d4448b5adcd066ae9edb11f96979ebc085b3

SHA512
93379b625e5dfc3c1af4b92ec1f380d99e696a9d42c4bcd469d2269c532d2fde3b1691b06a666fe78fe63cc75614a6dc2ef18dcacdbaf0a94ec810c026faaa4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43847.exe

Filesize
468KB

MD5
18c49e91c0a1045ba68f52a1112430dd

SHA1
166587908303024fa4c70ff26a901ac4343a905e

SHA256
53bfb1111911283f7afa179f9d68da30833a3ca1d75743aee3f14f7f5bbb2156

SHA512
c8a63a6d1626bceaf89736f22189360ef322ce136a134c529a4da13ddacf7161dbf415751aa6fe5b72f12da8c1b1f9670bcea2f3d9f40683ee850c3042c75cfe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44480.exe

Filesize
468KB

MD5
2723cb3dcfccf85aedbbfe731b1cc7f5

SHA1
10bc6b50efee5745fe516835dfc804fd1b3f1645

SHA256
b576bbc14da401464d4c31fa631f67eb02aa38a0d57e1f1ca735c867bdfa3b50

SHA512
020129a2da2392d54ef2b0000dcedb67b2ef906a8253d5bf61af51dd7dabf9ae51e2beb699834a7d72753b160914ed00401e58afb5a777d263eaccc1fbca0414

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47152.exe

Filesize
468KB

MD5
d60cdf1093d02dfaf2eba1076e3dc3d2

SHA1
5e0c8b0cc5db6cc7a45b212228d529fa3693ed30

SHA256
a8cee69fd250cafb42ee99bac929f508a482af18c456dd621fa5fc7de05270f3

SHA512
19f4c47fe437f61c25d1448af61b6572a3fca8febeee8d41ec87d575172c24569f5a42465bb62e41b8430398009013e1e3bf71c6bf64e858a18381a2dea90cd7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47376.exe

Filesize
468KB

MD5
593c06a1bb89f5d590d1a001eb5b0361

SHA1
34d46c4873547735dd706faafbb2f91824145dfa

SHA256
2e0fd998463346809b7bfdd20d4cc5ab41a1ff63aff1591cf2fa76b81a4272b7

SHA512
395ec6f6b46b34beb5b3909e382bcfb03235683c8451af614aba5bd6ffd70620de25a9f6b34ef49e30ab967d7c7721fb65e21048752fba5bbf1d65cab403506c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49223.exe

Filesize
468KB

MD5
e0d915509556671e4ecdd6fa1a70bc04

SHA1
465edb3f07f8fea42b2e54d110bebed51666d4a3

SHA256
fdb15a74db39d4f1d9c877f1c946df18749c1844f49b2e9d0be80361c272d20c

SHA512
ca98e790149b53e7bd83acc8cbeb84fa04b2cb52a2a750c505b66f0eac9ee0613502622cb66fc77dcc2cec0476513e20c01f0a4bd42f1436294d5174c4d581a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49888.exe

Filesize
468KB

MD5
780fb3ce9bed8d1d47e81e91cc18578a

SHA1
93d0f68533c5bd639711347f660bbdce6ebcfaf6

SHA256
5877aea115c7f37ce61ae0caa09c96547517042fd5e796ef6c5cb9877b8ec87c

SHA512
8fa9e0667a6547916cfdc1d27c2957bc75e5b1e73b27e4eb4f6aa2cbe64b493213327b2abacf8a6aef9e1bc08f10c69af13a3532b52b91fe8b20afffb957aa89

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51159.exe

Filesize
468KB

MD5
fbb987b87b8a396c1bf745bc1df50a5e

SHA1
27a8047b23bd018e03fcf89306f8f721eed00bcf

SHA256
563bf36f85efb7ca061e9364221c927daab7a63c0196eb3b32bf523de0398bd0

SHA512
4886166de9f2ce74ba388f1b08f5d14f817416485241b3bab94af5de4d1953c38e5c39702070b084d51b30556b8d369fe962c9eff2e9619cf032d8eeb657f175

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52856.exe

Filesize
468KB

MD5
12c0059250f266a9abaab5cc4d15def8

SHA1
c63ebc18a5d4d85bfc18ed28bb059fd32a7adfb4

SHA256
a4d53d65add5124536873424ae7f40fcacd7997607063166ea0cdcee2d34323a

SHA512
c17a1343ef2ecea3d93773a5a735e2e5613ae9415c2eb1fcfe25b5a8ac1df82e623b8e26e5d1837728e840d50a8bf076f9fe4fff539a0e68df570cb2d05dc798

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5869.exe

Filesize
468KB

MD5
28e47bd9cae0a0fa21ea0ac7bc4138d1

SHA1
cd5bdd5eb7c3b7687e709c8018e965dec9be832d

SHA256
06cb62703cf22f1bb7b08e12a18ae41f61327ed726b26a7b7639588e265db8c9

SHA512
c3e37cdf217f1946df1b757c771042ea4cfad7b295fc32f34816c231e6394144acda713ff9429866ef7671a95b14a1f688fd4b5064cff2f3605d024f40496634

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61008.exe

Filesize
468KB

MD5
bb19c7ce189fc0c2090ec1b52908e8db

SHA1
8e0e45cfd127471469216a5adf19bd89d1c47bd9

SHA256
e0245c1e2509692bba5e4065d1db3e544f3ec4a25f3317678bb3c14effc79990

SHA512
15ace07c95bb6df6c82e1fcf500582d7cacdfa0ff46a94c4f4ce6f534e6877e1aecf82e2cde1083a9cec3c3a23707b000381122bc3677402af3ecf1b696b83af

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61280.exe

Filesize
468KB

MD5
4436dc176e9ee6c9913a40bf0f8b3182

SHA1
ca7710b9688bc7f5c8c610369d808d217c3354af

SHA256
04a677bfcec6c096d5c1dc1bf3818dd6a9549c836770a236e2d33c911353f5a0

SHA512
09c8410dd34758775beb32c631104ba621a1b3196446548e0ffc9ea26b00363111ce8c2c3f3a8ac05c735cd63ebe812c185c655e92ee3c0a2fe2dfd375ca349d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61664.exe

Filesize
468KB

MD5
227e5e46f034b800ee8db4019db45e19

SHA1
6478f292312afc96316274cf768b56a93ecc99ae

SHA256
ed063c9d83cec31915e90d302af8ac5bee889a90bac5a4a3aa8167345cf94af9

SHA512
43d09466a40fa1cf26cf364a32e28c0fd9f05b633da813c8e6087dedc5829b5d825e408e1af82f9ce2f59fa0e4e1ccdaaef99456a0c518f388fe19703b517ee4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62206.exe

Filesize
468KB

MD5
ad7e6c02545f5dfc8e04b7d697435cac

SHA1
c3bd7ae2009ecff9e3a4d4ae4a61f3c8a0cf51a8

SHA256
6d999429387d4713ada4731c2031e8884e9670efaca8785decb7925ba28de392

SHA512
0b01bdea6647db9e411b8c382ba35d4bb3157ea70e43fb9cf80bcda0846c4b861f95a80eeeb36bb2ba36e391e77b8943bf6204296f72a2f3687cafb673dbcaa2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62328.exe

Filesize
468KB

MD5
11d12c1cd084d33f7c3d1fb286ca6a2a

SHA1
e5cb9f824f37b83a70bdcb1c1a733239da7e488d

SHA256
0c4eabd825688cbe18c34f7f58050257308b71981651ea4da8f81f32033e410c

SHA512
36d35f213456fd3bca5d9a8093641674ae115489c8cba9418a5a846b4840160695881d85a26878675802dc28e03678d96543ec9ee7a5d92011041458de0dbae2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7184.exe

Filesize
468KB

MD5
a0fff8b54de2d541877eaddf6ffba36a

SHA1
13cf149bb365f89c21a90c9f636fabeae7604228

SHA256
d476c5d5965dd28ec7bbd74e4819e4a073bd67820733385140f695a2bb430390

SHA512
7efab597a8345ca8a01b717d12372866792049ce8ea83d4997ebb045b7515a23044fda9a726bd01aba5255d23f1916851fb7fdec4051572a04ce42160bfc4d03

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-863.exe

Filesize
468KB

MD5
990c3ff741c00752445c7817af8455aa

SHA1
489be8789632127ffde46f304bf87056b087a330

SHA256
11884a8c575f037448f4277b6e97676c4de9f572b3b8b0a631921ac1d74ef5fa

SHA512
0d7ae9145dccc1c8d67e32a6d3cd7e96f2c786922009f265683ea6c777f905cd4da68c9e0307674235022559f100949b4cacfad0e07a14ecd24f230eadc37dc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9629.exe

Filesize
468KB

MD5
da631ee0d773dd0f7b93473bacd17231

SHA1
aa2c2412d0c9b069793b86d977d2b1f206680452

SHA256
792e7a177122e73e8fffb9546699b0fe9649bc2b9d9c6c97db3681f9c0e83d50

SHA512
a1fedfb4486bd73243de7961f337540ee3c04a72b63a3dcb3a4bc9f707bde4506894868d712ee63cc52a2cf9370b5bd3dd7ce2317adf15e0e6e5102fc6f77277

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-998.exe

Filesize
468KB

MD5
bc14f111db4668923b8dec67ef09c05f

SHA1
3a11033d8b98621534a709da490a1db25e072155

SHA256
7a7aca747a49bba2a38745548d15014540aacf6d511f116f054765a624d4785b

SHA512
5f37e4fd4764bbf67c4917304248a34462af05ba51345f8b5cfd28921f81dda027a6bf487663c5fc9037d03e679cf379512b6023fa0a4543340d3b4b8c92bb6e

Download Submit
memory/220-400-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/436-298-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/448-292-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/468-536-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/536-84-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/552-498-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/628-428-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/764-39-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/928-293-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/972-376-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1000-62-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1252-350-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1260-429-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1332-91-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1404-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1460-358-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1512-195-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1520-283-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1544-90-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1564-392-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1628-455-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1672-497-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1684-453-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1704-295-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1748-291-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1756-285-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1788-393-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1904-370-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1980-141-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2076-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2296-258-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2340-421-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2376-423-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2464-221-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2488-129-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2612-422-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2636-228-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2856-147-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2912-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2980-243-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3060-204-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3100-348-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3108-427-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3120-235-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3144-92-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3288-119-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3388-58-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3484-516-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3500-488-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3540-290-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3560-217-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3608-21-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3616-489-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3636-261-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3772-248-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3776-142-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3800-500-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3836-346-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3892-300-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4036-177-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4164-377-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4192-294-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4324-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4344-454-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4368-371-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4372-42-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4380-426-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4396-172-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4416-299-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4420-378-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4428-499-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4436-381-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4476-349-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4508-173-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4608-533-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4640-347-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4700-94-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4712-424-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4732-259-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4776-452-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4808-150-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4812-111-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4900-236-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4932-301-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4952-40-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5116-87-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5136-517-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5148-518-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5184-537-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5196-519-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5212-501-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5232-502-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5260-534-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5268-535-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5388-520-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5468-546-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15684-2617-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/16032-2560-0x00007FF85B000000-0x00007FF85B059000-memory.dmp

Filesize
356KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads