1334410aaae8f1946549056528ac1a09a7175e371961c137c545f29b98e4f7ae

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
26/07/2024, 14:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1c5a1bd33ad929daa3e4d940bc9cf680N.exe
Size 184KB
Sample240726-rt4rnsxbnd
SHA256 1334410aaae8f1946549056528ac1a09a7175e371961c137c545f29b98e4f7ae
MD5 1c5a1bd33ad929daa3e4d940bc9cf680
SHA1 6ab1bd6b852f328e21979a3554ee9222a5df7069
SHA512 0fe863d014e361de5462cdd93535df563e2d1dc81cdd68407062117467b4e0110838e6e951e0ab6bf2fa4a18950224e3b96bdb1bfebac57d7a8416887bc9234b
SSDEEP 3072:yJe9w0oHEj3NdppZkiB8urzLlvLqnxZu0np:yJ8oEbppb8IzLlzqnxZu0
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2756	Unicorn-36170.exe
2804	Unicorn-10726.exe
2940	Unicorn-56398.exe
2652	Unicorn-60093.exe
2596	Unicorn-61032.exe
2396	Unicorn-19445.exe
2848	Unicorn-48259.exe
2068	Unicorn-210.exe
2024	Unicorn-41797.exe
2032	Unicorn-24715.exe
1036	Unicorn-21185.exe
2860	Unicorn-13697.exe
608	Unicorn-63453.exe
2960	Unicorn-9805.exe
2764	Unicorn-51393.exe
2976	Unicorn-30226.exe
2260	Unicorn-26142.exe
1136	Unicorn-42478.exe
2108	Unicorn-22612.exe
1732	Unicorn-13863.exe
552	Unicorn-7319.exe
1368	Unicorn-35737.exe
1020	Unicorn-25924.exe
1868	Unicorn-22394.exe
1684	Unicorn-30200.exe
1156	Unicorn-26116.exe
2212	Unicorn-22032.exe
1992	Unicorn-63619.exe
1260	Unicorn-46536.exe
1008	Unicorn-18502.exe
1840	Unicorn-38368.exe
2724	Unicorn-15446.exe
2952	Unicorn-11917.exe
2116	Unicorn-31783.exe
2656	Unicorn-52203.exe
2572	Unicorn-28253.exe
2580	Unicorn-31207.exe
2168	Unicorn-31761.exe
2660	Unicorn-39375.exe
2248	Unicorn-23231.exe
2244	Unicorn-27869.exe
2036	Unicorn-39567.exe
1440	Unicorn-53526.exe
1704	Unicorn-52779.exe
2412	Unicorn-52779.exe
1496	Unicorn-48695.exe
2264	Unicorn-49634.exe
2720	Unicorn-61331.exe
1052	Unicorn-61331.exe
2884	Unicorn-37381.exe
2008	Unicorn-16682.exe
2980	Unicorn-58269.exe
2052	Unicorn-65306.exe
836	Unicorn-41356.exe
1320	Unicorn-20190.exe
1280	Unicorn-12021.exe
716	Unicorn-16106.exe
1696	Unicorn-29296.exe
1244	Unicorn-16298.exe
1996	Unicorn-20936.exe
776	Unicorn-40802.exe
624	Unicorn-58290.exe
2452	Unicorn-46593.exe
1872	Unicorn-17258.exe

Loads dropped DLL 64 IoCs

pid	Process
2644	1c5a1bd33ad929daa3e4d940bc9cf680N.exe
2644	1c5a1bd33ad929daa3e4d940bc9cf680N.exe
2644	1c5a1bd33ad929daa3e4d940bc9cf680N.exe
2756	Unicorn-36170.exe
2756	Unicorn-36170.exe
2644	1c5a1bd33ad929daa3e4d940bc9cf680N.exe
2804	Unicorn-10726.exe
2804	Unicorn-10726.exe
2756	Unicorn-36170.exe
2756	Unicorn-36170.exe
2940	Unicorn-56398.exe
2940	Unicorn-56398.exe
2596	Unicorn-61032.exe
2596	Unicorn-61032.exe
2396	Unicorn-19445.exe
2396	Unicorn-19445.exe
2940	Unicorn-56398.exe
2652	Unicorn-60093.exe
2940	Unicorn-56398.exe
2652	Unicorn-60093.exe
2804	Unicorn-10726.exe
2804	Unicorn-10726.exe
2848	Unicorn-48259.exe
2848	Unicorn-48259.exe
2596	Unicorn-61032.exe
2596	Unicorn-61032.exe
2652	Unicorn-60093.exe
2032	Unicorn-24715.exe
2032	Unicorn-24715.exe
2652	Unicorn-60093.exe
2024	Unicorn-41797.exe
1036	Unicorn-21185.exe
2024	Unicorn-41797.exe
1036	Unicorn-21185.exe
2068	Unicorn-210.exe
2068	Unicorn-210.exe
2396	Unicorn-19445.exe
2396	Unicorn-19445.exe
2416	WerFault.exe
2416	WerFault.exe
2416	WerFault.exe
2416	WerFault.exe
2416	WerFault.exe
2416	WerFault.exe
2416	WerFault.exe
2860	Unicorn-13697.exe
2860	Unicorn-13697.exe
2848	Unicorn-48259.exe
2848	Unicorn-48259.exe
608	Unicorn-63453.exe
608	Unicorn-63453.exe
2960	Unicorn-9805.exe
2960	Unicorn-9805.exe
2032	Unicorn-24715.exe
2032	Unicorn-24715.exe
2976	Unicorn-30226.exe
2976	Unicorn-30226.exe
2764	Unicorn-51393.exe
2764	Unicorn-51393.exe
2108	Unicorn-22612.exe
2108	Unicorn-22612.exe
1036	Unicorn-21185.exe
1036	Unicorn-21185.exe
2260	Unicorn-26142.exe

Program crash 7 IoCs

pid	pid_target	Process	procid_target
2416	2068	WerFault.exe	37
2440	1136	WerFault.exe	47
672	1840	WerFault.exe	61
1940	836	WerFault.exe	86
1132	2052	WerFault.exe	85
3144	3984	WerFault.exe	240
5020	3540	WerFault.exe	226

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23200.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7330.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23709.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45248.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36416.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21185.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55872.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63220.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53729.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9634.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25084.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30200.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51254.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54238.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50453.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7237.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4175.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46526.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61321.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43583.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11158.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59442.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16174.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35333.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43583.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44013.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56054.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58269.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54891.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3801.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32536.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5590.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53526.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51710.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26698.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33828.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36131.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-486.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13234.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58612.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36111.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25446.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8638.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10501.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24368.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8268.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12021.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24927.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9017.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15891.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57905.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50719.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15223.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39111.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53034.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12572.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56203.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-230.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15997.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54912.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58560.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34532.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42882.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23231.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2644	1c5a1bd33ad929daa3e4d940bc9cf680N.exe
2756	Unicorn-36170.exe
2940	Unicorn-56398.exe
2804	Unicorn-10726.exe
2596	Unicorn-61032.exe
2396	Unicorn-19445.exe
2652	Unicorn-60093.exe
2848	Unicorn-48259.exe
2068	Unicorn-210.exe
2032	Unicorn-24715.exe
1036	Unicorn-21185.exe
2024	Unicorn-41797.exe
2860	Unicorn-13697.exe
608	Unicorn-63453.exe
2960	Unicorn-9805.exe
2764	Unicorn-51393.exe
2976	Unicorn-30226.exe
1136	Unicorn-42478.exe
2260	Unicorn-26142.exe
2108	Unicorn-22612.exe
1732	Unicorn-13863.exe
552	Unicorn-7319.exe
1368	Unicorn-35737.exe
1020	Unicorn-25924.exe
1868	Unicorn-22394.exe
1684	Unicorn-30200.exe
1156	Unicorn-26116.exe
2212	Unicorn-22032.exe
1008	Unicorn-18502.exe
1992	Unicorn-63619.exe
1840	Unicorn-38368.exe
1260	Unicorn-46536.exe
2724	Unicorn-15446.exe
2116	Unicorn-31783.exe
2952	Unicorn-11917.exe
2572	Unicorn-28253.exe
2656	Unicorn-52203.exe
2580	Unicorn-31207.exe
2168	Unicorn-31761.exe
2660	Unicorn-39375.exe
2244	Unicorn-27869.exe
2248	Unicorn-23231.exe
2036	Unicorn-39567.exe
1440	Unicorn-53526.exe
1704	Unicorn-52779.exe
2264	Unicorn-49634.exe
2412	Unicorn-52779.exe
1496	Unicorn-48695.exe
2720	Unicorn-61331.exe
1052	Unicorn-61331.exe
2884	Unicorn-37381.exe
2008	Unicorn-16682.exe
2980	Unicorn-58269.exe
2052	Unicorn-65306.exe
836	Unicorn-41356.exe
1320	Unicorn-20190.exe
716	Unicorn-16106.exe
1280	Unicorn-12021.exe
1696	Unicorn-29296.exe
1244	Unicorn-16298.exe
776	Unicorn-40802.exe
1996	Unicorn-20936.exe
624	Unicorn-58290.exe
2452	Unicorn-46593.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 2756	2644	1c5a1bd33ad929daa3e4d940bc9cf680N.exe	30
PID 2644 wrote to memory of 2756	2644	1c5a1bd33ad929daa3e4d940bc9cf680N.exe	30
PID 2644 wrote to memory of 2756	2644	1c5a1bd33ad929daa3e4d940bc9cf680N.exe	30
PID 2644 wrote to memory of 2756	2644	1c5a1bd33ad929daa3e4d940bc9cf680N.exe	30
PID 2756 wrote to memory of 2804	2756	Unicorn-36170.exe	31
PID 2756 wrote to memory of 2804	2756	Unicorn-36170.exe	31
PID 2756 wrote to memory of 2804	2756	Unicorn-36170.exe	31
PID 2756 wrote to memory of 2804	2756	Unicorn-36170.exe	31
PID 2644 wrote to memory of 2940	2644	1c5a1bd33ad929daa3e4d940bc9cf680N.exe	32
PID 2644 wrote to memory of 2940	2644	1c5a1bd33ad929daa3e4d940bc9cf680N.exe	32
PID 2644 wrote to memory of 2940	2644	1c5a1bd33ad929daa3e4d940bc9cf680N.exe	32
PID 2644 wrote to memory of 2940	2644	1c5a1bd33ad929daa3e4d940bc9cf680N.exe	32
PID 2804 wrote to memory of 2652	2804	Unicorn-10726.exe	33
PID 2804 wrote to memory of 2652	2804	Unicorn-10726.exe	33
PID 2804 wrote to memory of 2652	2804	Unicorn-10726.exe	33
PID 2804 wrote to memory of 2652	2804	Unicorn-10726.exe	33
PID 2756 wrote to memory of 2596	2756	Unicorn-36170.exe	34
PID 2756 wrote to memory of 2596	2756	Unicorn-36170.exe	34
PID 2756 wrote to memory of 2596	2756	Unicorn-36170.exe	34
PID 2756 wrote to memory of 2596	2756	Unicorn-36170.exe	34
PID 2940 wrote to memory of 2396	2940	Unicorn-56398.exe	35
PID 2940 wrote to memory of 2396	2940	Unicorn-56398.exe	35
PID 2940 wrote to memory of 2396	2940	Unicorn-56398.exe	35
PID 2940 wrote to memory of 2396	2940	Unicorn-56398.exe	35
PID 2596 wrote to memory of 2848	2596	Unicorn-61032.exe	36
PID 2596 wrote to memory of 2848	2596	Unicorn-61032.exe	36
PID 2596 wrote to memory of 2848	2596	Unicorn-61032.exe	36
PID 2596 wrote to memory of 2848	2596	Unicorn-61032.exe	36
PID 2396 wrote to memory of 2068	2396	Unicorn-19445.exe	37
PID 2396 wrote to memory of 2068	2396	Unicorn-19445.exe	37
PID 2396 wrote to memory of 2068	2396	Unicorn-19445.exe	37
PID 2396 wrote to memory of 2068	2396	Unicorn-19445.exe	37
PID 2940 wrote to memory of 2024	2940	Unicorn-56398.exe	38
PID 2940 wrote to memory of 2024	2940	Unicorn-56398.exe	38
PID 2940 wrote to memory of 2024	2940	Unicorn-56398.exe	38
PID 2940 wrote to memory of 2024	2940	Unicorn-56398.exe	38
PID 2652 wrote to memory of 2032	2652	Unicorn-60093.exe	39
PID 2652 wrote to memory of 2032	2652	Unicorn-60093.exe	39
PID 2652 wrote to memory of 2032	2652	Unicorn-60093.exe	39
PID 2652 wrote to memory of 2032	2652	Unicorn-60093.exe	39
PID 2804 wrote to memory of 1036	2804	Unicorn-10726.exe	40
PID 2804 wrote to memory of 1036	2804	Unicorn-10726.exe	40
PID 2804 wrote to memory of 1036	2804	Unicorn-10726.exe	40
PID 2804 wrote to memory of 1036	2804	Unicorn-10726.exe	40
PID 2848 wrote to memory of 2860	2848	Unicorn-48259.exe	41
PID 2848 wrote to memory of 2860	2848	Unicorn-48259.exe	41
PID 2848 wrote to memory of 2860	2848	Unicorn-48259.exe	41
PID 2848 wrote to memory of 2860	2848	Unicorn-48259.exe	41
PID 2596 wrote to memory of 608	2596	Unicorn-61032.exe	42
PID 2596 wrote to memory of 608	2596	Unicorn-61032.exe	42
PID 2596 wrote to memory of 608	2596	Unicorn-61032.exe	42
PID 2596 wrote to memory of 608	2596	Unicorn-61032.exe	42
PID 2032 wrote to memory of 2960	2032	Unicorn-24715.exe	44
PID 2032 wrote to memory of 2960	2032	Unicorn-24715.exe	44
PID 2032 wrote to memory of 2960	2032	Unicorn-24715.exe	44
PID 2032 wrote to memory of 2960	2032	Unicorn-24715.exe	44
PID 2652 wrote to memory of 2764	2652	Unicorn-60093.exe	43
PID 2652 wrote to memory of 2764	2652	Unicorn-60093.exe	43
PID 2652 wrote to memory of 2764	2652	Unicorn-60093.exe	43
PID 2652 wrote to memory of 2764	2652	Unicorn-60093.exe	43
PID 2024 wrote to memory of 2260	2024	Unicorn-41797.exe	45
PID 2024 wrote to memory of 2260	2024	Unicorn-41797.exe	45
PID 2024 wrote to memory of 2260	2024	Unicorn-41797.exe	45
PID 2024 wrote to memory of 2260	2024	Unicorn-41797.exe	45

C:\Users\Admin\AppData\Local\Temp\1c5a1bd33ad929daa3e4d940bc9cf680N.exe
"C:\Users\Admin\AppData\Local\Temp\1c5a1bd33ad929daa3e4d940bc9cf680N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36170.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36170.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10726.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10726.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60093.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60093.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24715.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9805.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25924.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31207.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16298.exe
        9⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1819.exe
        10⤵
        
        PID:2788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9188.exe
        11⤵
        
        PID:3396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15733.exe
        12⤵
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4409.exe
        12⤵
        
        PID:4344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30729.exe
        11⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61927.exe
        12⤵
        
        PID:6180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58560.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:3476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-486.exe
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:4172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34951.exe
        11⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18710.exe
        9⤵
        
        PID:600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47118.exe
        10⤵
        
        PID:3820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42124.exe
        11⤵
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56457.exe
        11⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41367.exe
        10⤵
        
        PID:4912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20936.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59188.exe
        9⤵
        
        PID:2752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32027.exe
        10⤵
        
        PID:2784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4912.exe
        11⤵
        
        PID:3204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54238.exe
        12⤵
        System Location Discovery: System Language Discovery
        
        PID:4504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25980.exe
        13⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39461.exe
        13⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59539.exe
        12⤵
        
        PID:5904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46142.exe
        11⤵
        
        PID:4188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51543.exe
        12⤵
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27427.exe
        12⤵
        
        PID:6988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63220.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:3256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48872.exe
        11⤵
        
        PID:4656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50920.exe
        12⤵
        
        PID:5412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60401.exe
        12⤵
        
        PID:6768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45717.exe
        11⤵
        
        PID:5144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12161.exe
        9⤵
        
        PID:1788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2961.exe
        10⤵
        
        PID:3592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-750.exe
        10⤵
        
        PID:3496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16245.exe
        11⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59083.exe
        11⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31761.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40802.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45784.exe
        9⤵
        
        PID:1948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7330.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14590.exe
        11⤵
        
        PID:3320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39971.exe
        11⤵
        
        PID:3432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28746.exe
        12⤵
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5590.exe
        12⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10184.exe
        10⤵
        
        PID:3468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35769.exe
        11⤵
        
        PID:4816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53034.exe
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:4484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3801.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:2468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8420.exe
        10⤵
        
        PID:2304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44819.exe
        11⤵
        
        PID:3760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19696.exe
        12⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34948.exe
        11⤵
        
        PID:4248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64648.exe
        12⤵
        
        PID:496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25060.exe
        12⤵
        
        PID:6072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25913.exe
        10⤵
        
        PID:4064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19696.exe
        11⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54891.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44087.exe
        9⤵
        
        PID:1820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6277.exe
        10⤵
        
        PID:3244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34532.exe
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48097.exe
        11⤵
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15410.exe
        10⤵
        
        PID:3460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44741.exe
        9⤵
        
        PID:3440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34916.exe
        10⤵
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3556.exe
        10⤵
        
        PID:5540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22394.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39375.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58290.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18540.exe
        9⤵
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36111.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:2844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20865.exe
        11⤵
        
        PID:1528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27632.exe
        12⤵
        
        PID:3364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54620.exe
        13⤵
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35704.exe
        13⤵
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50818.exe
        12⤵
        
        PID:2324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45483.exe
        11⤵
        
        PID:3824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26063.exe
        12⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20167.exe
        12⤵
        
        PID:5336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58368.exe
        10⤵
        
        PID:1184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2852.exe
        11⤵
        
        PID:3704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34726.exe
        12⤵
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22571.exe
        13⤵
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15559.exe
        13⤵
        
        PID:6964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23594.exe
        12⤵
        
        PID:5088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22535.exe
        11⤵
        
        PID:4264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52062.exe
        12⤵
        
        PID:6908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44450.exe
        9⤵
        
        PID:1480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32925.exe
        10⤵
        
        PID:884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22557.exe
        11⤵
        
        PID:4364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25322.exe
        11⤵
        
        PID:2828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13386.exe
        10⤵
        
        PID:3136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10785.exe
        11⤵
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33094.exe
        11⤵
        
        PID:6196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10350.exe
        8⤵
        
        PID:3016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35535.exe
        9⤵
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28457.exe
        10⤵
        
        PID:1956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35333.exe
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:3120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51820.exe
        12⤵
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45289.exe
        12⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34014.exe
        11⤵
        
        PID:1540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40163.exe
        10⤵
        
        PID:3652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32223.exe
        11⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45248.exe
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:5272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24927.exe
        9⤵
        
        PID:1640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41628.exe
        10⤵
        
        PID:4272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1560.exe
        10⤵
        
        PID:5400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46593.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41892.exe
        8⤵
        
        PID:2696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52639.exe
        9⤵
        
        PID:2564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36516.exe
        10⤵
        
        PID:3688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26698.exe
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:3756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1859.exe
        12⤵
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3542.exe
        11⤵
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64009.exe
        10⤵
        
        PID:3868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17620.exe
        11⤵
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63665.exe
        11⤵
        
        PID:5292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61362.exe
        8⤵
        
        PID:2532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1461.exe
        9⤵
        
        PID:3424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49739.exe
        10⤵
        
        PID:1764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42595.exe
        10⤵
        
        PID:5356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7543.exe
        9⤵
        
        PID:4672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51393.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26116.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23231.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12296.exe
        8⤵
        
        PID:2460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22240.exe
        9⤵
        
        PID:2524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49453.exe
        10⤵
        
        PID:3056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50787.exe
        11⤵
        
        PID:4432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26416.exe
        12⤵
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27344.exe
        12⤵
        
        PID:6724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43583.exe
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:5080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4341.exe
        10⤵
        
        PID:3412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2425.exe
        11⤵
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53598.exe
        11⤵
        
        PID:6256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41839.exe
        9⤵
        
        PID:2576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18665.exe
        10⤵
        
        PID:4452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43214.exe
        8⤵
        
        PID:2232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24565.exe
        9⤵
        
        PID:2584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31602.exe
        10⤵
        
        PID:4176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34683.exe
        11⤵
        
        PID:6356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60159.exe
        10⤵
        
        PID:4748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46526.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:4008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39649.exe
        10⤵
        
        PID:1576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9249.exe
        10⤵
        
        PID:6452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24719.exe
        7⤵
        
        PID:2680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54912.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65104.exe
        9⤵
        
        PID:3452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2795.exe
        10⤵
        
        PID:4204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9069.exe
        10⤵
        
        PID:4584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1949.exe
        9⤵
        
        PID:4356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36416.exe
        10⤵
        
        PID:5332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37947.exe
        8⤵
        
        PID:3540
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3540 -s 200
        9⤵
        Program crash
        
        PID:5020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27869.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17258.exe
        7⤵
        Executes dropped EXE
        
        PID:1872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17964.exe
        8⤵
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15306.exe
        9⤵
        
        PID:796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32541.exe
        10⤵
        
        PID:448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53880.exe
        11⤵
        
        PID:4736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49609.exe
        11⤵
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17553.exe
        10⤵
        
        PID:3532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57905.exe
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24927.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32344.exe
        10⤵
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53994.exe
        10⤵
        
        PID:2632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39488.exe
        8⤵
        
        PID:1316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61321.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:2772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7237.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:3584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10110.exe
        11⤵
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28636.exe
        11⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11518.exe
        10⤵
        
        PID:3028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20428.exe
        9⤵
        
        PID:3836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32059.exe
        10⤵
        
        PID:4384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54848.exe
        10⤵
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18518.exe
        7⤵
        
        PID:2092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53215.exe
        8⤵
        
        PID:2284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20481.exe
        9⤵
        
        PID:1220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58078.exe
        10⤵
        
        PID:4868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36323.exe
        11⤵
        
        PID:6416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3511.exe
        10⤵
        
        PID:4720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38357.exe
        9⤵
        
        PID:3548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21471.exe
        10⤵
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33287.exe
        8⤵
        
        PID:1556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19563.exe
        9⤵
        
        PID:4500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62821.exe
        9⤵
        
        PID:5440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21185.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21185.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30226.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30200.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39567.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58783.exe
        8⤵
        
        PID:1812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7330.exe
        9⤵
        
        PID:1096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42328.exe
        10⤵
        
        PID:3308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47310.exe
        11⤵
        
        PID:4000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2134.exe
        12⤵
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15507.exe
        12⤵
        
        PID:5136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39696.exe
        10⤵
        
        PID:3152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52103.exe
        11⤵
        
        PID:5368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2234.exe
        9⤵
        
        PID:3372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24882.exe
        10⤵
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23467.exe
        10⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24719.exe
        7⤵
        
        PID:2388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43812.exe
        8⤵
        
        PID:2836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4995.exe
        9⤵
        
        PID:3852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39111.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:4664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38575.exe
        11⤵
        
        PID:6312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51560.exe
        10⤵
        
        PID:4208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50958.exe
        9⤵
        
        PID:4628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39042.exe
        10⤵
        
        PID:6684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9634.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49879.exe
        9⤵
        
        PID:4332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13955.exe
        9⤵
        
        PID:5672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53526.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15805.exe
        7⤵
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23200.exe
        8⤵
        
        PID:1376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37777.exe
        9⤵
        
        PID:3128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25982.exe
        10⤵
        
        PID:4780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2031.exe
        11⤵
        
        PID:7128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52520.exe
        10⤵
        
        PID:4616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9001.exe
        9⤵
        
        PID:4152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14070.exe
        10⤵
        
        PID:6408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30163.exe
        8⤵
        
        PID:3156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62608.exe
        9⤵
        
        PID:3348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19783.exe
        10⤵
        
        PID:5344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54217.exe
        9⤵
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19670.exe
        7⤵
        
        PID:1864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42302.exe
        8⤵
        
        PID:3116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23709.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4409.exe
        9⤵
        
        PID:4636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28347.exe
        8⤵
        
        PID:4540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63619.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52779.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15997.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2971.exe
        8⤵
        
        PID:2812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2125.exe
        9⤵
        
        PID:3840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2961.exe
        10⤵
        
        PID:3596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55995.exe
        11⤵
        
        PID:5308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20359.exe
        11⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49043.exe
        10⤵
        
        PID:4812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50283.exe
        8⤵
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51254.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23786.exe
        9⤵
        
        PID:4180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3526.exe
        7⤵
        
        PID:1672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17549.exe
        8⤵
        
        PID:3284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32536.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4876.exe
        9⤵
        
        PID:4832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54310.exe
        8⤵
        
        PID:4224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5902.exe
        9⤵
        
        PID:6424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17703.exe
        6⤵
        
        PID:2040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55872.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51264.exe
        8⤵
        
        PID:3608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51394.exe
        9⤵
        
        PID:3964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17869.exe
        10⤵
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51807.exe
        10⤵
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28238.exe
        9⤵
        
        PID:5016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27444.exe
        8⤵
        
        PID:3948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3371.exe
        9⤵
        
        PID:4836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9152.exe
        9⤵
        
        PID:5248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55410.exe
        7⤵
        
        PID:3796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18499.exe
        8⤵
        
        PID:4728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39042.exe
        9⤵
        
        PID:6696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56604.exe
        8⤵
        
        PID:4444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61032.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61032.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48259.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48259.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13697.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13863.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15446.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16682.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46085.exe
        9⤵
        
        PID:1712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50719.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:1548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4611.exe
        11⤵
        
        PID:3104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56054.exe
        12⤵
        System Location Discovery: System Language Discovery
        
        PID:3272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19148.exe
        13⤵
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3872.exe
        13⤵
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12670.exe
        12⤵
        
        PID:4520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11876.exe
        11⤵
        
        PID:3320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28746.exe
        12⤵
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5590.exe
        12⤵
        System Location Discovery: System Language Discovery
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51243.exe
        10⤵
        
        PID:3232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39526.exe
        11⤵
        
        PID:3600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57331.exe
        12⤵
        
        PID:5004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54656.exe
        12⤵
        
        PID:5396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32239.exe
        11⤵
        
        PID:4844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59442.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:2180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29801.exe
        10⤵
        
        PID:3324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41903.exe
        11⤵
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13319.exe
        11⤵
        
        PID:5516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26645.exe
        10⤵
        
        PID:4320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36416.exe
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:5284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22135.exe
        8⤵
        
        PID:1924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21939.exe
        9⤵
        
        PID:1612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65296.exe
        10⤵
        
        PID:3620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11539.exe
        11⤵
        
        PID:4808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17320.exe
        11⤵
        
        PID:5216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28902.exe
        9⤵
        
        PID:3708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17984.exe
        10⤵
        
        PID:4980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58269.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42001.exe
        8⤵
        
        PID:2520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13770.exe
        9⤵
        
        PID:1656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64367.exe
        10⤵
        
        PID:4040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47279.exe
        11⤵
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52062.exe
        12⤵
        
        PID:6900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18695.exe
        11⤵
        
        PID:4132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31689.exe
        10⤵
        
        PID:4800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26790.exe
        11⤵
        
        PID:6708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2893.exe
        9⤵
        
        PID:3224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2235.exe
        10⤵
        
        PID:4972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25060.exe
        10⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30853.exe
        8⤵
        
        PID:2408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36194.exe
        9⤵
        
        PID:2612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8638.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:4240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42467.exe
        11⤵
        
        PID:6528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59837.exe
        10⤵
        
        PID:4932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45483.exe
        9⤵
        
        PID:3732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8268.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58974.exe
        10⤵
        
        PID:5476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11917.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16106.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13687.exe
        8⤵
        
        PID:620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2670.exe
        9⤵
        
        PID:1048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30521.exe
        10⤵
        
        PID:3552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63646.exe
        11⤵
        
        PID:3172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13234.exe
        12⤵
        System Location Discovery: System Language Discovery
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44013.exe
        12⤵
        System Location Discovery: System Language Discovery
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48275.exe
        11⤵
        
        PID:5084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21995.exe
        9⤵
        
        PID:3092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28509.exe
        10⤵
        
        PID:3408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32389.exe
        11⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4838.exe
        11⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9017.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:4528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27729.exe
        8⤵
        
        PID:1760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53646.exe
        9⤵
        
        PID:1580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2193.exe
        10⤵
        
        PID:4092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26255.exe
        11⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52648.exe
        11⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60527.exe
        10⤵
        
        PID:5060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51949.exe
        9⤵
        
        PID:3352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13234.exe
        10⤵
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44013.exe
        10⤵
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6074.exe
        7⤵
        
        PID:1100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64699.exe
        8⤵
        
        PID:536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51923.exe
        9⤵
        
        PID:3928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50787.exe
        10⤵
        
        PID:4424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26224.exe
        11⤵
        
        PID:2932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38636.exe
        11⤵
        
        PID:6652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43583.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:2060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38705.exe
        9⤵
        
        PID:4592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39317.exe
        10⤵
        
        PID:7044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63853.exe
        8⤵
        
        PID:3100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24316.exe
        9⤵
        
        PID:4076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17620.exe
        10⤵
        
        PID:5656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63665.exe
        10⤵
        
        PID:5296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13760.exe
        9⤵
        
        PID:4768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7319.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31783.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65306.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2052
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 240
        8⤵
        Program crash
        
        PID:1132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6074.exe
        7⤵
        
        PID:920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63739.exe
        8⤵
        
        PID:2940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54305.exe
        9⤵
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24368.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:4608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49801.exe
        10⤵
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26645.exe
        9⤵
        
        PID:4312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32872.exe
        10⤵
        
        PID:5836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41356.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:836
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 836 -s 240
        7⤵
        Program crash
        
        PID:1940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63453.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63453.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35737.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52203.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12021.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62696.exe
        8⤵
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15691.exe
        9⤵
        
        PID:2920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56438.exe
        10⤵
        
        PID:3500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23323.exe
        11⤵
        
        PID:5208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44480.exe
        11⤵
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48467.exe
        10⤵
        
        PID:4148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12260.exe
        9⤵
        
        PID:3660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43359.exe
        10⤵
        
        PID:380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15891.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12161.exe
        8⤵
        
        PID:1484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6100.exe
        9⤵
        
        PID:3516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32526.exe
        10⤵
        
        PID:5300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63976.exe
        10⤵
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9582.exe
        7⤵
        
        PID:1056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7330.exe
        8⤵
        
        PID:1564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8996.exe
        9⤵
        
        PID:3188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40704.exe
        10⤵
        
        PID:4688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41632.exe
        10⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46142.exe
        9⤵
        
        PID:4196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34107.exe
        10⤵
        
        PID:6464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63220.exe
        8⤵
        
        PID:3264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30917.exe
        9⤵
        
        PID:4412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52266.exe
        9⤵
        
        PID:5056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29296.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19561.exe
        7⤵
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19858.exe
        8⤵
        
        PID:2760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6661.exe
        9⤵
        
        PID:3700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22280.exe
        10⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11148.exe
        10⤵
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3542.exe
        9⤵
        
        PID:4884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64009.exe
        8⤵
        
        PID:3872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26255.exe
        9⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57308.exe
        9⤵
        
        PID:5484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28253.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20190.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58612.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3246.exe
        8⤵
        
        PID:1676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36983.exe
        9⤵
        
        PID:3520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47118.exe
        10⤵
        
        PID:3804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10603.exe
        11⤵
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11148.exe
        11⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40682.exe
        10⤵
        
        PID:4948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51757.exe
        9⤵
        
        PID:3896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28912.exe
        10⤵
        
        PID:5504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31677.exe
        10⤵
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51710.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23382.exe
        9⤵
        
        PID:3080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21979.exe
        10⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40011.exe
        10⤵
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16562.exe
        9⤵
        
        PID:4476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65254.exe
        7⤵
        
        PID:696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32733.exe
        8⤵
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33828.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27807.exe
        10⤵
        
        PID:5160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61024.exe
        10⤵
        
        PID:7112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14336.exe
        9⤵
        
        PID:820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42249.exe
        8⤵
        
        PID:3768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15721.exe
        9⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48938.exe
        9⤵
        
        PID:6320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5498.exe
        6⤵
        
        PID:2252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35919.exe
        7⤵
        
        PID:2240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15597.exe
        8⤵
        
        PID:3996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18909.exe
        9⤵
        
        PID:4992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61542.exe
        9⤵
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28814.exe
        8⤵
        
        PID:932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19852.exe
        7⤵
        
        PID:3176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47928.exe
        8⤵
        
        PID:1832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3872.exe
        8⤵
        
        PID:6120
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56398.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56398.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19445.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19445.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-210.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-210.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42478.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38368.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61331.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32525.exe
        8⤵
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52810.exe
        9⤵
        
        PID:2876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20289.exe
        10⤵
        
        PID:1300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64741.exe
        11⤵
        
        PID:4624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12980.exe
        12⤵
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8685.exe
        11⤵
        
        PID:4828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42249.exe
        10⤵
        
        PID:3952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57308.exe
        11⤵
        
        PID:5512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43214.exe
        8⤵
        
        PID:2984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53729.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36131.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:4704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10501.exe
        9⤵
        
        PID:4404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55186.exe
        10⤵
        
        PID:6860
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 216
        7⤵
        Program crash
        
        PID:672
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1136 -s 236
        6⤵
        Program crash
        
        PID:2440
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2068 -s 236
        5⤵
        Loads dropped DLL
        Program crash
        
        PID:2416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22612.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22612.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22032.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48695.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65197.exe
        7⤵
        
        PID:2536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15223.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38519.exe
        9⤵
        
        PID:3888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25084.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:3924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22078.exe
        11⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24542.exe
        11⤵
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34948.exe
        10⤵
        
        PID:4260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11637.exe
        8⤵
        
        PID:4084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29350.exe
        9⤵
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59264.exe
        9⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11694.exe
        7⤵
        
        PID:2880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65296.exe
        8⤵
        
        PID:3612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57071.exe
        9⤵
        
        PID:3444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31014.exe
        10⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-230.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59069.exe
        9⤵
        
        PID:4348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51244.exe
        10⤵
        
        PID:2824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5301.exe
        8⤵
        
        PID:3944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46743.exe
        9⤵
        
        PID:6272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4299.exe
        6⤵
        
        PID:1000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43812.exe
        7⤵
        
        PID:1160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36516.exe
        8⤵
        
        PID:3680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28499.exe
        9⤵
        
        PID:4756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14772.exe
        9⤵
        
        PID:5460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38513.exe
        8⤵
        
        PID:4488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22571.exe
        9⤵
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15559.exe
        9⤵
        
        PID:6972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5358.exe
        7⤵
        
        PID:3776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48021.exe
        8⤵
        
        PID:4760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28529.exe
        8⤵
        
        PID:2360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49634.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44777.exe
        6⤵
        
        PID:2544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30408.exe
        7⤵
        
        PID:2332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9188.exe
        8⤵
        
        PID:3388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8737.exe
        9⤵
        
        PID:4604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50904.exe
        9⤵
        
        PID:5740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45239.exe
        7⤵
        
        PID:3416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25759.exe
        8⤵
        
        PID:5100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34759.exe
        8⤵
        
        PID:5580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14626.exe
        6⤵
        
        PID:2556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20756.exe
        7⤵
        
        PID:4020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62930.exe
        8⤵
        
        PID:5112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23786.exe
        8⤵
        
        PID:4284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46765.exe
        7⤵
        
        PID:4740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56203.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45264.exe
        8⤵
        
        PID:7084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41797.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41797.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26142.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26142.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46536.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61331.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20081.exe
        7⤵
        
        PID:2588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15031.exe
        8⤵
        
        PID:408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41560.exe
        9⤵
        
        PID:3808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12821.exe
        10⤵
        
        PID:5040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2471.exe
        10⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18285.exe
        9⤵
        
        PID:4544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12980.exe
        10⤵
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58835.exe
        8⤵
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23081.exe
        9⤵
        
        PID:3216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30064.exe
        10⤵
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25846.exe
        9⤵
        
        PID:4120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48451.exe
        7⤵
        
        PID:1876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4445.exe
        8⤵
        
        PID:1736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48462.exe
        9⤵
        
        PID:3724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62022.exe
        10⤵
        
        PID:4684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50904.exe
        10⤵
        
        PID:5748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-226.exe
        9⤵
        
        PID:4352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61269.exe
        8⤵
        
        PID:3968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3371.exe
        9⤵
        
        PID:4904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33656.exe
        9⤵
        
        PID:5260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21787.exe
        6⤵
        
        PID:1816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23200.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5379.exe
        8⤵
        
        PID:3484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52437.exe
        9⤵
        
        PID:3860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50453.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10733.exe
        10⤵
        
        PID:6340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9209.exe
        9⤵
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4175.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3883.exe
        9⤵
        
        PID:4652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63250.exe
        9⤵
        
        PID:6496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26053.exe
        7⤵
        
        PID:3676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16174.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35868.exe
        9⤵
        
        PID:5064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3872.exe
        9⤵
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24538.exe
        8⤵
        
        PID:4976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37381.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65005.exe
        6⤵
        
        PID:1608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64040.exe
        7⤵
        
        PID:2272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13080.exe
        8⤵
        
        PID:3636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23133.exe
        9⤵
        
        PID:4292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21046.exe
        9⤵
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59510.exe
        8⤵
        
        PID:4460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64345.exe
        9⤵
        
        PID:1380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4205.exe
        9⤵
        
        PID:6368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54559.exe
        7⤵
        
        PID:3736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25982.exe
        8⤵
        
        PID:4788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41891.exe
        9⤵
        
        PID:5544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36006.exe
        6⤵
        
        PID:1040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12312.exe
        7⤵
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4793.exe
        8⤵
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11679.exe
        8⤵
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62862.exe
        7⤵
        
        PID:4108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26079.exe
        8⤵
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14900.exe
        8⤵
        
        PID:6844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18502.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18502.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52779.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41653.exe
        6⤵
        
        PID:1744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55187.exe
        7⤵
        
        PID:1944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8503.exe
        8⤵
        
        PID:3984
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3984 -s 240
        9⤵
        Program crash
        
        PID:3144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25446.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2949.exe
        9⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25258.exe
        9⤵
        
        PID:5240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17226.exe
        7⤵
        
        PID:4052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46262.exe
        8⤵
        
        PID:4724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12572.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11158.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47780.exe
        8⤵
        
        PID:5788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55742.exe
        6⤵
        
        PID:1664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41477.exe
        7⤵
        
        PID:3504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20632.exe
        8⤵
        
        PID:940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62821.exe
        8⤵
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10501.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37890.exe
        8⤵
        
        PID:6568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13619.exe
        5⤵
        
        PID:1540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47896.exe
        6⤵
        
        PID:2340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14974.exe
        7⤵
        
        PID:3972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21576.exe
        8⤵
        
        PID:3580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42882.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45264.exe
        9⤵
        
        PID:7076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54217.exe
        8⤵
        
        PID:772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24953.exe
        7⤵
        
        PID:4072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14018.exe
        8⤵
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40063.exe
        8⤵
        
        PID:7016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27589.exe
        6⤵
        
        PID:3168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37793.exe
        7⤵
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64583.exe
        7⤵
        
        PID:5952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Unicorn-11679.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-11679.exe
Size 184KB
SHA256 3e9ba83210a9fb74a297ea958d063fe5548426f2229ce7e2c26cbf9565c058be
MD5 7ad96b8fefb89ad6ba0f8610746947d5
SHA1 6b672eb314ae61f738457c770992ccc69eb8c027
SHA512 b4ff69fe034d8e045173d375d1d356ae4c25f64596f16033c82c7dd6a4fecfd071279cbc4267dadad41e6ceb840ec24d5b50786903bdff95c863301e7d9bb0d3
SSDEEP 3072:FJe9w0oHEj3edppZkTB8urz8lvLqnxZudnp:FJ8oEapp88Iz8lzqnxZud
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-15410.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-15410.exe
Size 184KB
SHA256 a362f513ce52ce087d6bb8b0263748c5eaa86d2cb14e8343d015b9ffbdc209f7
MD5 195f9a0eab5fefd41a6be0fc9b6e054b
SHA1 e7cccb26e18c3323bd71c31c0a81d7ec6f1f646b
SHA512 6176b737d6fed2211a331bc88ca90985144d8387079781929b830e7e0def26a1e9fa1801345abeea2da3a43ef578deb81935c30ce694889a0add097a706bc678
SSDEEP 3072:qlH9w0oHEj3Kdp3ZkiB8urzTlvLqnxZu0np:qlxoEGp3b8IzTlzqnxZu0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-26790.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-26790.exe
Size 184KB
SHA256 a8b9e9eaeff554d31c2991a660bb1bd38e9b17810b03db92b775810b4a2dccd6
MD5 3978ab21ad5df14e1042b67cdd38f8ae
SHA1 c377f3f5c30605a7fb28477561a123d5c0ab56b1
SHA512 1366e448ed63a4e505449797107d5219a40de34c050a3120665930f6cb4c745589f283b1b44a0e4643b718ae83f170a3566a20b1f2b72450f7c30c4db23d19d1
SSDEEP 3072:LJe950oHEj3LdpQZk+B8urz5lvLqnxZu0np:LJ5oExpQf8Iz5lzqnxZu0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-39971.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-39971.exe
Size 184KB
SHA256 f552a71e442bda4446ac2a40ca3510603fa0f86382c47df5a9b5216c7c0f86b0
MD5 ca617a36bbf739c10fc86fd12aef80a4
SHA1 ea6b775dadf7541297a4fe5edc6e3da9e12642c5
SHA512 e5071eb7ee49d90a96f2316c28014f0847a5bc7e39e4d16772a138263b0b768e717910c3dc88bd17de31d652aa960b8e36c980702b66baefdc33d8e244ec9e18
SSDEEP 3072:/Je9w0oHEj3NdppZk+J8urzBlvLqnxZu0np:/J8oEbppX8IzBlzqnxZu0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-40163.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-40163.exe
Size 184KB
SHA256 844cf411ba15f0ffa8ef50a81e969b35bd596d85c01544de3031ec5fd5af1f4c
MD5 75ebb653a3cc03e0fc28dcd346301648
SHA1 9bc8f627f0aa25212bb5669edbcb1f18f571e52e
SHA512 f38d4a3e942b24d0a92e7f02fe611e29e9907c6bbfe7cb4a8c08466a991d7a5bcde1e7da742c95ffcdf802b48919995f7c3a1697be77717b030b493302fa6edc
SSDEEP 3072:4JH9w0oHEj3Ndp3ZkiB8urz3lvLqnxZu0np:4JxoEbp3b8Iz3lzqnxZu0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-42124.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-42124.exe
Size 184KB
SHA256 ed15959c8202225be22fe8500e9622c6b89e187344c04a4a717b81618494f30c
MD5 ee36be0351b70c257fd5c622bb3a70d3
SHA1 756f8af4aa2048fce906627c6ba7f429e0204813
SHA512 8b1fc333d3a4e98c6c15b2686296d7e14b333f49566389b458c4c9e5ced9aee66ab6c783c67d2ab8df6a5774135c15d8a040591fd5681bd415d0ff89de1fde5e
SSDEEP 3072:QJe9w0oHEjSNdppZk+J8urzflvLqnxZumnp:QJ8oNbppX8IzflzqnxZum
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-44450.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-44450.exe
Size 184KB
SHA256 2bb92e75b42ddef26d6e2292a9fc7a8e380ddbded310762c94dc686f5588dabe
MD5 56ebea6acb91e8825da1fab43c29a608
SHA1 f8496967239c7ccb1a9201e9620d95f2101dbed7
SHA512 a32449ec11a8e9478d9c838ee6150edc801243e72dd007291af1d33af2787055e2cd07ce6da085b7144a759f6d3bdf3e06563bb33610aa46959fee96f1278cd8
SSDEEP 3072:MJH9w0oHEj3Ndp3ZkiB8urzVlvLqnxZu0np:MJxoEbp3b8IzVlzqnxZu0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-47279.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-47279.exe
Size 184KB
SHA256 3ffb09b3148fc943a45bd14e277375782d998f6dfe525144a6118c421db8d4c6
MD5 b8ddbf23142777cfe452f8245d58372c
SHA1 a17cc15a79beab4feed317d5a0fa05b167a483ab
SHA512 dcec9fc824ef5c7722dd83e492992e1c26db67705d79a560df3dab0159d7dee63f8159b1ee5d24e00eab0c4a8fe39a486ad55aca84af59be7ddfd3d40670f482
SSDEEP 3072:OJe950oHEj3LdpQZk+B8urzZlvLqnxZu0np:OJ5oExpQf8IzZlzqnxZu0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-51244.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-51244.exe
Size 184KB
SHA256 944477eb7d747fb07dda0f66a1dcb16155e416f02705c347d10303e08cd6566e
MD5 958270a088fe287f3cc1dc73d8a37328
SHA1 46f6cb21cdfc696065084e00a27aaeb9f82a2497
SHA512 b5a7baf95a1a204994b3f1ebc7907dc750d0fc04fa1a36d3aeb955d4ce9eacb6e5028c1bcbe7e11b3b27bd27d9540839c4612cd7c8ba3c826b6f01721b08ddf8
SSDEEP 3072:2Je9b0oHEU3cdppZkiB8urzolvLqnxZu0np:2JzofIppb8IzolzqnxZu0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-51543.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-51543.exe
Size 184KB
SHA256 c5ce9dc56812b0a68cfbe5d6c60f64dbf285984203d1ff9794ddc9c344957aa8
MD5 9417e46b389e90e97bf1e172c4fc6102
SHA1 3b96528c985535ca3bd6bd6e9560d05e3b403052
SHA512 1563bcf55c77a88189b5797b3a9b2c38c64f5c592de75e9b427eb6d097afffcd662fe7de065ed542ec3819de21473084a2ad2baf95ab15679d91c1f6b5eb2213
SSDEEP 3072:FlH9w0oHEj3Ndp3Z/i58urzFlvLqnxZu0np:FlxoEbp3o8IzFlzqnxZu0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-51820.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-51820.exe
Size 184KB
SHA256 d47aee8732fb26339216141dc15e15c2d62d30e93077fc645d5900823105c5a3
MD5 9ad65ac356848e052ec77ab07e7dff61
SHA1 265c7c59b3ef60a7d9847a9e0d61a9f06bdf0b45
SHA512 8e14aaddcfb304046898f5389dfafe1c9856c2044c8a95f13c47d74dfbcd7614a9d55a5a8d7979bebe5717656e9c81c29bab36bd2031bd39dfa12ecd14365945
SSDEEP 3072:xJH9w0oHEj3Ndp3ZkiOyurz3lvLqnxZu0np:xJxoEbp3QyIz3lzqnxZu0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-56398.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-56398.exe
Size 184KB
SHA256 b723a3f6e206c682d0a7c81bba0749e1adcd2d5eafb46bc2c1caee9fed883089
MD5 d173f3b8e4a3bc0637e01d34eff4251b
SHA1 e1484e48c346d38c35996392df1e7415fe9c431c
SHA512 ca4bd5a5f4f3608e0e439b13ec8339fecd95370968c7474d66a35e7217252b1ed00403abc1a2e7169195e698a5507fb9369d27104e095ce9721ad5e2d6ed4d0f
SSDEEP 3072:yJe9w0oHEj3edppZkiB8urzLlvLqnxZu0np:yJ8oEappb8IzLlzqnxZu0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-6661.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-6661.exe
Size 184KB
SHA256 8aac409d830d12e0bb24d8062ce5d6fb2bcd18c9b72727008fe26110c26ef3bc
MD5 8a011b113314795658d46c31c5e00412
SHA1 8d3786d4fba4d54a5bb3d2cca522492e0bf5ca89
SHA512 9ab75268457f33ee46079ff2365d869366636031a26cbcc382d18e5eeea1138efc41a0e4423d2ee42478236f953cae4722ad0609529122e1b25ef047f061c8e5
SSDEEP 3072:pJe9w0oHEjYNdppZk+J8urzqlvLqnxZu0np:pJ8orbppX8IzqlzqnxZu0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-9805.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-9805.exe
Size 184KB
SHA256 2bad1f509787b7639a3cf426ae1ba56d3bdff2f2a824318a57f25b022af50fc9
MD5 7626cd55a5e73376b4371eaf5e7d5976
SHA1 aa3299b66e0c9503c72b8c646edded587a1ae022
SHA512 309d076f0856e57110c102b8c7afaed41e3d13c705df3f64dcb18beb28b53dbcf1ae400e1189725fdbf4007449444421cf5445a1b0ed779f8a599ddaf0877a2b
SSDEEP 3072:ylH9w0oHEj3Ndp3ZkiB8urzClvLqnxZu0np:ylxoEbp3b8IzClzqnxZu0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-10726.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-10726.exe
Size 184KB
SHA256 892568b5e8fa0656deed1b83eaf0df03dfd4b77b1ae9826872bbfdb840e273af
MD5 a5cd4f80d483a8bda841f69f5ea448ed
SHA1 61c6e432d1cb1686a8f413b155a5529cbd0ec7a4
SHA512 a25fdb3b52510139846d7c613426f1897f10ac6c14c6a73bc721ad16a45837dc549d486d1807279a822ce80619dbb985e658c09699722d629462e1e1c800eec5
SSDEEP 3072:yJH9w0oHEj3NdppZkiB8urz5lvLqnxZu0np:yJxoEbppb8Iz5lzqnxZu0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-13697.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-13697.exe
Size 184KB
SHA256 1a6fdf16758a0c70226707bc43487ea4e55c67eb5c0705aa4f2f8614d2152efe
MD5 7d6ad6062c29344777848b67e57ad5e4
SHA1 833750495be8fd1d4b98d7278a26f005c6cd7083
SHA512 96544a60a81fb02ff641cb2858c00a3431bec1fe83b1d3ac0474a15f1433799db1a68e786f48873b5707e4ab2b014dd4c3d232204580aeae08ef25bb05e25c69
SSDEEP 3072:yJe9r0oHEj3NdppZk+B8urzIlvLqnxZu0np:yJboEbppf8IzIlzqnxZu0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-19445.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-19445.exe
Size 184KB
SHA256 f8ed1423f61255dd2c3c6308297ef928accfbce568843a2b2fb99cdccfd2ca13
MD5 9915537243de90ccea56fbf82305e2e1
SHA1 b72b559cacbab1e7608c927e99adf53edb6e659a
SHA512 cf987e2d45f518adbd83d6c4a8762250387d30b9793de12cab7a1320c2ecf8fd3601eaf4a41bda34a0e9a67ec05bead51995e535ecc45b2c264b584ab459e262
SSDEEP 3072:yJe9w0oHEU3edppZkiB8urzLlvLqnxZu0np:yJ8ofappb8IzLlzqnxZu0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-210.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-210.exe
Size 184KB
SHA256 0673e2e10bdcce76896a17756e4408928c747100bdc8e830419445097511d1b1
MD5 e598ba78d3645014e7e849a205ddb779
SHA1 06f09be0050ca1c5c424c8969d43ca2acd41a085
SHA512 078d106631515a55b948acd700c9481f848153f4af9d2395dfa372078368c5608b5594c8d792a7d7a72a757db35c660a95ebc8ce8c25ae3a16c6fd74b7700d28
SSDEEP 3072:yJe9w0oHEU3edppZkiB8urzLlvLqWxZu0np:yJ8ofappb8IzLlzqWxZu0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-21185.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-21185.exe
Size 184KB
SHA256 6cdba0237657bda7458844912383989af4d2bf7e5c4f85ee5f9af5390ba99eac
MD5 c3c75449e47531d1d1ec150f916acccb
SHA1 b070998357e2cc43aec7b421a90e42fcc0cd615e
SHA512 df2307a41704199a4a95a9d692350a15d2125701c5d97a9e050f397e4bf5314efd7c5ad63989fb6da8ab206894417b2b1d1cc17f259e7d923defcb4e3f9199a3
SSDEEP 3072:yJH9w0oHEj3NdppZkiB8urzMlvLqnxZu0np:yJxoEbppb8IzMlzqnxZu0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-24715.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-24715.exe
Size 184KB
SHA256 40716ae28cacfa3471fa08327d4eb720a31bf2c4af9727d7a3481afd5da1b2ed
MD5 24a9010f94db8136838034ef54141779
SHA1 e3a93e0900f83726c908ca9f3513fee0622452e4
SHA512 313e9093e92b988c81595d7dfba336a4ef8ee0dd1157c85e5734a96e7c3bb9886dbc5c17f2dcce012c88927f249c200100fdbcc94ae0ea1d909d7c49d2f0026c
SSDEEP 3072:yJH9w0oHEj3Ndp3ZkiB8urzClvLqnxZu0np:yJxoEbp3b8IzClzqnxZu0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-26142.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-26142.exe
Size 184KB
SHA256 f95ca0a351262f80f69bcb59dfbd25745c4e8f0f730c62d38bfa2ef8f52f5b56
MD5 1d082a6bdd335636f3376e28829bde2e
SHA1 32ea2b155354a4c6ffd7f9a4f5e65196e3aea062
SHA512 898b5919ecb6f3634f12109289c0210cfb79c3364fec4edc13ce46adf27edc11fa54f9ae8bbf9793f498521f15040710e6b4f0b5ec58b349ada8e13af61a4da5
SSDEEP 3072:QJe9w0oHEj3edppZkPB8urzLlvLqnxZu0np:QJ8oEappY8IzLlzqnxZu0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-30226.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-30226.exe
Size 184KB
SHA256 74206c2d2cf9fec6e7b078cd5ca5b512b9b885646a1581b54e6eec31e12647f4
MD5 57136e128f2fe76ac5fedefa896d22ce
SHA1 404057685833b898a63d09c1e6f1c442f2b432f6
SHA512 bdf4f15acc3666ebeeba08117c60713757891e8c7b4c471bf47732bf599ec169619445caed1c765ecbed3578bf8e85a41d39eac68a1c9da1f7362878b91e73ee
SSDEEP 3072:yJH9w0oHEj3NdppZkPB8urzMlvLqnxZu0np:yJxoEbppY8IzMlzqnxZu0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-36170.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-36170.exe
Size 184KB
SHA256 34ec1fc73984a1681b1c7934e7c3d607c9db5d1b1752fee110406c77c37671b4
MD5 cbaceba6b84efff98dbf550b500b1682
SHA1 7563bff121c1a0843f11a35576579e9c3815ee9f
SHA512 0987095e3d31568077191113f676f5f9c199ee92bd4566950054440e67efff5e57560c7f9443726c137993588e969ec2dba3744adedfa7fbbac0a889260c2c4e
SSDEEP 3072:yJe9w0oHEj3NdppZkiB8urz5lvLqnxZu0np:yJ8oEbppb8Iz5lzqnxZu0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-41797.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-41797.exe
Size 184KB
SHA256 699583827beb8605cdc35104b1653593dcc383e59d13b4f244cd8e5de0356747
MD5 ca65736acf68576ab22e2b3064cf16b3
SHA1 99fa568f67bf6b8d3fe4e8bd643d3686e7e750ba
SHA512 21695add1d2412a5e0b723c69b3c0038a62e2e286ae79c76c95a8841832377ff3a85ef9466aa1b6b8ddeb4dc40303abb2db074081decbfcebd11b9fc66786b50
SSDEEP 3072:QJe9w0oHEj3edppZkiB8urzLlvLqnxZu0np:QJ8oEappb8IzLlzqnxZu0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-42478.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-42478.exe
Size 184KB
SHA256 519e1f81a3b39fbf048b81fa9219d748f2de8cb1170c012b8d3cd9c6a1d0ef97
MD5 98e9392f5dc4486062ef74ebb425e9e4
SHA1 f424d5bfeff3a3ca8b6bb85a67a5e4005a475eb4
SHA512 2d2a365b33033a816e9bd38805b7dfd577c82ef7b4c030cb51d4e44273f9a482bdd9c22a248ceed59572b85c09a65122684c1d862d49b004561097710923cb64
SSDEEP 3072:yJe9w0oHEU3edppZkiB8urz0lvLqWxZu0np:yJ8ofappb8Iz0lzqWxZu0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-48259.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-48259.exe
Size 184KB
SHA256 4f97ce1e4f32dd0bfe345bd957fa2f081b47234f47a6521fcdb8ae8d3ba0684f
MD5 50f5a5bd2c045ea2702e6b27a54f237d
SHA1 55eac420b63105d287d40de162b2026269f272ed
SHA512 a5dee1753f3d64ed5c9c7b6c6c5ba47f8a5258915d3748154b9439451d6cfe4d4e80e59bf873828f62806656a09871790ac4a96dc0c42d8a0816a13a773768d3
SSDEEP 3072:yJe9w0oHEj3NdppZk+B8urzIlvLqnxZu0np:yJ8oEbppf8IzIlzqnxZu0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-51393.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-51393.exe
Size 184KB
SHA256 94cde411630529eb9a4fa7f2673458182cedc0a99d95b810a4a4be102249c07c
MD5 de0eab67cd924f1bd27eb3a24605ecf8
SHA1 19bf9b87eb2d6f517064346feff6b89884509ef7
SHA512 ab8b6e46b0b7a0a33d483421c3311cfbb7a6d2fa7bec8daedf67936d7951b040e4a685cb6402c41c4dd6bc9909760cda923d8f5d31c21d852f17e2c44d178b64
SSDEEP 3072:yJH9w0oHPj3NdppZkiB8urzClvLqnxZu0np:yJxoTbppb8IzClzqnxZu0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-60093.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-60093.exe
Size 184KB
SHA256 dd8561d7293ac42eef576a1404f71b6dbef47d2bc5ae37d3b4a7d7a1cb0f9215
MD5 101e4a358d480f50f0b37c7245acbec9
SHA1 aab4342c1f23796bb6a21dc7b35af6df82afc2eb
SHA512 3b20713fe86dc97ce02bbd4ec75680b7661023f8cdee51f812fee090c23ac04bd94c3d6831c45303726264eab85791ba2c3dae61958129238a6e15bcfd25e438
SSDEEP 3072:yJH9w0oHEj3NdppZkiB8urzClvLqnxZu0np:yJxoEbppb8IzClzqnxZu0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-61032.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-61032.exe
Size 184KB
SHA256 c6514f904a9d948a7d5651f8ceedd8da87e4e09e5150e3b2bc21e64aaa9d0edb
MD5 b7cf2258d537228c1ce08c9ec7a59778
SHA1 0536b5c5e25c6cef8617485bd5b5b05e74b2d3ba
SHA512 426f1cdb9574967c9830f6a2e549d47e999684e8a3cd71ebcaadb1d2ead10a089f833c8e72008082aca90f7f127db68d1522e77737e7850f44016726316bd525
SSDEEP 3072:yJe9w0oHEj3NdppZk+B8urz5lvLqnxZu0np:yJ8oEbppf8Iz5lzqnxZu0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-63453.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-63453.exe
Size 184KB
SHA256 31cf9d573787387cdc3ec527c62fc62a2bdbcab69d4db29c0349611e636c2d84
MD5 d1b90d645f9e8e7d7691d6b82d39ec07
SHA1 cb76129d0123b0faa67f7cac5fe95bb2a606fdba
SHA512 3f8812cfd8928b2adc00c345ba115fafbadfc3827aa7c147fca1c1519d02e40f2951cbc095fb4dd935ee5d81e969d5194d4be0c93768b96203a562528476095f
SSDEEP 3072:yJe9w0oHEj3NdppZk+J8urz5lvLqnxZu0np:yJ8oEbppX8Iz5lzqnxZu0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads