fdf6928570dedb5f2456a21d3da63f455f9103b7f959f1f86b09f68262fffdaf

Analysis

max time kernel
120s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 04:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

198abd148ad22dcaf020bc4e4e9ea3f0N.exe
Size

468KB
MD5

198abd148ad22dcaf020bc4e4e9ea3f0
SHA1

4727e0564a92bc8f09603c8d21e9b1b49a71b4b7
SHA256

fdf6928570dedb5f2456a21d3da63f455f9103b7f959f1f86b09f68262fffdaf
SHA512

02847b482532e3a0b37cc5a495f847ad3e383c4ee1e43447da35abcf589e57f1bd9f5a2bad4d298625149ae567ce937259f3fd84450f99247cc7b92298ff4b15
SSDEEP

3072:OQoHogIKI05QtbYJHzcOcfr/GChzPmp9nLHePVPdZwuLOXDg/Ol0:OQIoD8QtOH4OcfxmQjZwQsDg/

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
756	Unicorn-53896.exe
1540	Unicorn-50440.exe
1272	Unicorn-29697.exe
4396	Unicorn-34312.exe
4916	Unicorn-34312.exe
3252	Unicorn-58031.exe
4280	Unicorn-62770.exe
3868	Unicorn-52283.exe
2216	Unicorn-65282.exe
2668	Unicorn-19611.exe
3168	Unicorn-3009.exe
2336	Unicorn-3274.exe
4868	Unicorn-49718.exe
4720	Unicorn-35982.exe
5076	Unicorn-29345.exe
2192	Unicorn-2807.exe
4476	Unicorn-61145.exe
4340	Unicorn-47465.exe
4064	Unicorn-43359.exe
864	Unicorn-30553.exe
2036	Unicorn-31622.exe
2000	Unicorn-11756.exe
4748	Unicorn-47885.exe
2428	Unicorn-27900.exe
5012	Unicorn-38836.exe
2120	Unicorn-47766.exe
1088	Unicorn-47766.exe
3784	Unicorn-41636.exe
3280	Unicorn-62841.exe
2636	Unicorn-26329.exe
2092	Unicorn-21267.exe
2124	Unicorn-12104.exe
4672	Unicorn-12789.exe
2592	Unicorn-29053.exe
2640	Unicorn-31455.exe
2060	Unicorn-36246.exe
2052	Unicorn-18265.exe
4908	Unicorn-15996.exe
4448	Unicorn-30687.exe
452	Unicorn-50553.exe
4128	Unicorn-35478.exe
4328	Unicorn-34025.exe
2288	Unicorn-14159.exe
4596	Unicorn-27894.exe
4376	Unicorn-3656.exe
2660	Unicorn-15123.exe
4300	Unicorn-21254.exe
3220	Unicorn-21254.exe
3300	Unicorn-37782.exe
1788	Unicorn-3272.exe
2644	Unicorn-53542.exe
1292	Unicorn-13670.exe
5060	Unicorn-65472.exe
540	Unicorn-1004.exe
4952	Unicorn-52400.exe
3640	Unicorn-17532.exe
788	Unicorn-28467.exe
1976	Unicorn-27199.exe
3420	Unicorn-55161.exe
4784	Unicorn-56230.exe
224	Unicorn-2623.exe
760	Unicorn-23293.exe
2024	Unicorn-45561.exe
2232	Unicorn-25887.exe

Program crash 4 IoCs

pid	pid_target	Process	procid_target
17180	16876	WerFault.exe	929
17388	14956	WerFault.exe	715
17148	8788	WerFault.exe	404
13732	8440	WerFault.exe	389

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51764.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38089.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38777.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34851.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12540.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60042.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21772.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36823.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44836.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35324.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39062.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65472.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25878.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37433.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34312.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2723.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27073.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2807.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35907.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23699.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21792.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42237.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35324.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43568.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47764.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7580.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27894.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23657.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16150.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54519.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19611.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7640.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51673.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3708.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54925.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58871.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26918.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11043.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27900.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59753.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59753.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51552.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53152.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43833.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33574.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5855.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54137.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6815.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14865.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15961.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52320.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19887.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6579.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53896.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43359.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20063.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42688.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	Process not Found

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	Process not Found

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	Process not Found

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16432	Process not Found
Token: SeChangeNotifyPrivilege	16432	Process not Found
Token: 33	16432	Process not Found
Token: SeIncBasePriorityPrivilege	16432	Process not Found

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
456	198abd148ad22dcaf020bc4e4e9ea3f0N.exe
756	Unicorn-53896.exe
1272	Unicorn-29697.exe
1540	Unicorn-50440.exe
4396	Unicorn-34312.exe
3252	Unicorn-58031.exe
4916	Unicorn-34312.exe
4280	Unicorn-62770.exe
3868	Unicorn-52283.exe
2668	Unicorn-19611.exe
2216	Unicorn-65282.exe
4868	Unicorn-49718.exe
4720	Unicorn-35982.exe
2336	Unicorn-3274.exe
3168	Unicorn-3009.exe
5076	Unicorn-29345.exe
2192	Unicorn-2807.exe
4476	Unicorn-61145.exe
4064	Unicorn-43359.exe
4340	Unicorn-47465.exe
864	Unicorn-30553.exe
2036	Unicorn-31622.exe
2000	Unicorn-11756.exe
1088	Unicorn-47766.exe
2120	Unicorn-47766.exe
3280	Unicorn-62841.exe
2428	Unicorn-27900.exe
3784	Unicorn-41636.exe
4748	Unicorn-47885.exe
5012	Unicorn-38836.exe
2636	Unicorn-26329.exe
2092	Unicorn-21267.exe
2124	Unicorn-12104.exe
2592	Unicorn-29053.exe
4672	Unicorn-12789.exe
2640	Unicorn-31455.exe
2060	Unicorn-36246.exe
2052	Unicorn-18265.exe
4908	Unicorn-15996.exe
452	Unicorn-50553.exe
4448	Unicorn-30687.exe
4128	Unicorn-35478.exe
4328	Unicorn-34025.exe
2288	Unicorn-14159.exe
4596	Unicorn-27894.exe
4300	Unicorn-21254.exe
2660	Unicorn-15123.exe
3220	Unicorn-21254.exe
2644	Unicorn-53542.exe
1292	Unicorn-13670.exe
540	Unicorn-1004.exe
4952	Unicorn-52400.exe
3640	Unicorn-17532.exe
788	Unicorn-28467.exe
3300	Unicorn-37782.exe
4376	Unicorn-3656.exe
1976	Unicorn-27199.exe
5060	Unicorn-65472.exe
1788	Unicorn-3272.exe
3420	Unicorn-55161.exe
224	Unicorn-2623.exe
4784	Unicorn-56230.exe
760	Unicorn-23293.exe
2024	Unicorn-45561.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 456 wrote to memory of 756	456	198abd148ad22dcaf020bc4e4e9ea3f0N.exe	91
PID 456 wrote to memory of 756	456	198abd148ad22dcaf020bc4e4e9ea3f0N.exe	91
PID 456 wrote to memory of 756	456	198abd148ad22dcaf020bc4e4e9ea3f0N.exe	91
PID 756 wrote to memory of 1540	756	Unicorn-53896.exe	94
PID 756 wrote to memory of 1540	756	Unicorn-53896.exe	94
PID 756 wrote to memory of 1540	756	Unicorn-53896.exe	94
PID 456 wrote to memory of 1272	456	198abd148ad22dcaf020bc4e4e9ea3f0N.exe	95
PID 456 wrote to memory of 1272	456	198abd148ad22dcaf020bc4e4e9ea3f0N.exe	95
PID 456 wrote to memory of 1272	456	198abd148ad22dcaf020bc4e4e9ea3f0N.exe	95
PID 1540 wrote to memory of 4396	1540	Unicorn-50440.exe	97
PID 1540 wrote to memory of 4396	1540	Unicorn-50440.exe	97
PID 1540 wrote to memory of 4396	1540	Unicorn-50440.exe	97
PID 1272 wrote to memory of 4916	1272	Unicorn-29697.exe	98
PID 1272 wrote to memory of 4916	1272	Unicorn-29697.exe	98
PID 1272 wrote to memory of 4916	1272	Unicorn-29697.exe	98
PID 456 wrote to memory of 3252	456	198abd148ad22dcaf020bc4e4e9ea3f0N.exe	99
PID 456 wrote to memory of 3252	456	198abd148ad22dcaf020bc4e4e9ea3f0N.exe	99
PID 456 wrote to memory of 3252	456	198abd148ad22dcaf020bc4e4e9ea3f0N.exe	99
PID 756 wrote to memory of 4280	756	Unicorn-53896.exe	100
PID 756 wrote to memory of 4280	756	Unicorn-53896.exe	100
PID 756 wrote to memory of 4280	756	Unicorn-53896.exe	100
PID 4396 wrote to memory of 3868	4396	Unicorn-34312.exe	103
PID 4396 wrote to memory of 3868	4396	Unicorn-34312.exe	103
PID 4396 wrote to memory of 3868	4396	Unicorn-34312.exe	103
PID 1540 wrote to memory of 2216	1540	Unicorn-50440.exe	104
PID 1540 wrote to memory of 2216	1540	Unicorn-50440.exe	104
PID 1540 wrote to memory of 2216	1540	Unicorn-50440.exe	104
PID 4916 wrote to memory of 2668	4916	Unicorn-34312.exe	105
PID 4916 wrote to memory of 2668	4916	Unicorn-34312.exe	105
PID 4916 wrote to memory of 2668	4916	Unicorn-34312.exe	105
PID 456 wrote to memory of 3168	456	198abd148ad22dcaf020bc4e4e9ea3f0N.exe	106
PID 456 wrote to memory of 3168	456	198abd148ad22dcaf020bc4e4e9ea3f0N.exe	106
PID 456 wrote to memory of 3168	456	198abd148ad22dcaf020bc4e4e9ea3f0N.exe	106
PID 4280 wrote to memory of 2336	4280	Unicorn-62770.exe	107
PID 4280 wrote to memory of 2336	4280	Unicorn-62770.exe	107
PID 4280 wrote to memory of 2336	4280	Unicorn-62770.exe	107
PID 1272 wrote to memory of 4720	1272	Unicorn-29697.exe	108
PID 1272 wrote to memory of 4720	1272	Unicorn-29697.exe	108
PID 1272 wrote to memory of 4720	1272	Unicorn-29697.exe	108
PID 756 wrote to memory of 4868	756	Unicorn-53896.exe	109
PID 756 wrote to memory of 4868	756	Unicorn-53896.exe	109
PID 756 wrote to memory of 4868	756	Unicorn-53896.exe	109
PID 3252 wrote to memory of 5076	3252	Unicorn-58031.exe	110
PID 3252 wrote to memory of 5076	3252	Unicorn-58031.exe	110
PID 3252 wrote to memory of 5076	3252	Unicorn-58031.exe	110
PID 2216 wrote to memory of 2192	2216	Unicorn-65282.exe	111
PID 2216 wrote to memory of 2192	2216	Unicorn-65282.exe	111
PID 2216 wrote to memory of 2192	2216	Unicorn-65282.exe	111
PID 1540 wrote to memory of 4476	1540	Unicorn-50440.exe	112
PID 1540 wrote to memory of 4476	1540	Unicorn-50440.exe	112
PID 1540 wrote to memory of 4476	1540	Unicorn-50440.exe	112
PID 2668 wrote to memory of 4340	2668	Unicorn-19611.exe	113
PID 2668 wrote to memory of 4340	2668	Unicorn-19611.exe	113
PID 2668 wrote to memory of 4340	2668	Unicorn-19611.exe	113
PID 4916 wrote to memory of 4064	4916	Unicorn-34312.exe	114
PID 4916 wrote to memory of 4064	4916	Unicorn-34312.exe	114
PID 4916 wrote to memory of 4064	4916	Unicorn-34312.exe	114
PID 3868 wrote to memory of 864	3868	Unicorn-52283.exe	115
PID 3868 wrote to memory of 864	3868	Unicorn-52283.exe	115
PID 3868 wrote to memory of 864	3868	Unicorn-52283.exe	115
PID 4868 wrote to memory of 2036	4868	Unicorn-49718.exe	116
PID 4868 wrote to memory of 2036	4868	Unicorn-49718.exe	116
PID 4868 wrote to memory of 2036	4868	Unicorn-49718.exe	116
PID 4396 wrote to memory of 2000	4396	Unicorn-34312.exe	117

C:\Users\Admin\AppData\Local\Temp\198abd148ad22dcaf020bc4e4e9ea3f0N.exe
"C:\Users\Admin\AppData\Local\Temp\198abd148ad22dcaf020bc4e4e9ea3f0N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:456
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53896.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53896.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50440.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50440.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34312.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34312.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52283.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30553.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34025.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39033.exe
        8⤵
        
        PID:2304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25977.exe
        9⤵
        
        PID:6696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55113.exe
        10⤵
        
        PID:9048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10545.exe
        11⤵
        
        PID:1104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9356.exe
        10⤵
        
        PID:12252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26303.exe
        10⤵
        
        PID:4468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        10⤵
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19887.exe
        9⤵
        
        PID:9376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54519.exe
        9⤵
        
        PID:12728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        9⤵
        
        PID:6072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32447.exe
        8⤵
        
        PID:7108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23801.exe
        9⤵
        
        PID:9280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6632.exe
        10⤵
        
        PID:13224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57120.exe
        9⤵
        
        PID:12784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45143.exe
        9⤵
        
        PID:17064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
        9⤵
        
        PID:1056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47764.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51552.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49375.exe
        8⤵
        
        PID:904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21772.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21561.exe
        8⤵
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6120.exe
        9⤵
        
        PID:5156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24639.exe
        9⤵
        
        PID:13712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
        9⤵
        
        PID:5428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64480.exe
        8⤵
        
        PID:10236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51504.exe
        9⤵
        
        PID:16900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10545.exe
        9⤵
        
        PID:232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35303.exe
        8⤵
        
        PID:11840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6080.exe
        8⤵
        
        PID:15924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50519.exe
        7⤵
        
        PID:7484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56710.exe
        8⤵
        
        PID:13076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27611.exe
        8⤵
        
        PID:2568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36253.exe
        7⤵
        
        PID:8644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48964.exe
        7⤵
        
        PID:14984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65472.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41145.exe
        7⤵
        
        PID:5904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48185.exe
        8⤵
        
        PID:6792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39753.exe
        9⤵
        
        PID:9444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9647.exe
        9⤵
        
        PID:12016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60903.exe
        9⤵
        
        PID:17148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34028.exe
        8⤵
        
        PID:9596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45687.exe
        8⤵
        
        PID:6600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7286.exe
        7⤵
        
        PID:1512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35392.exe
        7⤵
        
        PID:12600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2262.exe
        7⤵
        
        PID:17080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46830.exe
        7⤵
        
        PID:16840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5523.exe
        6⤵
        
        PID:6136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-712.exe
        7⤵
        
        PID:6332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23801.exe
        8⤵
        
        PID:9272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57120.exe
        8⤵
        
        PID:12744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
        8⤵
        
        PID:5216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34028.exe
        7⤵
        
        PID:9552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45303.exe
        7⤵
        
        PID:13560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4486.exe
        6⤵
        
        PID:7616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10191.exe
        6⤵
        
        PID:12592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2792.exe
        6⤵
        
        PID:16360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11756.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12540.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2437.exe
        7⤵
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15756.exe
        8⤵
        
        PID:8216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20665.exe
        9⤵
        
        PID:13092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27611.exe
        9⤵
        
        PID:2332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36823.exe
        8⤵
        
        PID:11576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49744.exe
        8⤵
        
        PID:16436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1672.exe
        8⤵
        
        PID:17392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22175.exe
        7⤵
        
        PID:8028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43609.exe
        8⤵
        
        PID:17380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13475.exe
        7⤵
        
        PID:10344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64269.exe
        7⤵
        
        PID:15548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43863.exe
        6⤵
        
        PID:6180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17241.exe
        7⤵
        
        PID:6372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52486.exe
        8⤵
        
        PID:10960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49277.exe
        8⤵
        
        PID:17048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
        8⤵
        
        PID:16780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13091.exe
        7⤵
        
        PID:10312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46288.exe
        7⤵
        
        PID:15596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11983.exe
        6⤵
        
        PID:6816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34022.exe
        6⤵
        
        PID:11624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57901.exe
        6⤵
        
        PID:16560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54505.exe
        6⤵
        
        PID:16476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15123.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9432.exe
        6⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3304.exe
        7⤵
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55641.exe
        8⤵
        
        PID:13036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16145.exe
        9⤵
        
        PID:16916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6815.exe
        8⤵
        
        PID:1476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58912.exe
        7⤵
        
        PID:1516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14204.exe
        6⤵
        
        PID:6852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47065.exe
        7⤵
        
        PID:8580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16870.exe
        7⤵
        
        PID:16144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
        7⤵
        
        PID:5352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51620.exe
        6⤵
        
        PID:10408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40343.exe
        6⤵
        
        PID:16256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43568.exe
        5⤵
        
        PID:6032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8325.exe
        6⤵
        
        PID:7888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50649.exe
        7⤵
        
        PID:11820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20543.exe
        7⤵
        
        PID:17296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
        7⤵
        
        PID:5348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-508.exe
        6⤵
        
        PID:4124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36772.exe
        6⤵
        
        PID:14800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61860.exe
        5⤵
        
        PID:8928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64038.exe
        6⤵
        
        PID:15624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35746.exe
        6⤵
        
        PID:1388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3756.exe
        5⤵
        
        PID:12140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44598.exe
        5⤵
        
        PID:16760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65282.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65282.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2807.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12789.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14424.exe
        7⤵
        
        PID:1432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33849.exe
        8⤵
        
        PID:6228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-712.exe
        9⤵
        
        PID:7176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4408.exe
        10⤵
        
        PID:9648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16870.exe
        10⤵
        
        PID:16292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5295.exe
        9⤵
        
        PID:10504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23699.exe
        9⤵
        
        PID:14580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63337.exe
        9⤵
        
        PID:6408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60157.exe
        8⤵
        
        PID:9816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40868.exe
        8⤵
        
        PID:13836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48576.exe
        7⤵
        
        PID:6284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56649.exe
        8⤵
        
        PID:7564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19990.exe
        9⤵
        
        PID:10984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59552.exe
        9⤵
        
        PID:15724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34883.exe
        9⤵
        
        PID:17244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27611.exe
        9⤵
        
        PID:17108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59216.exe
        8⤵
        
        PID:10776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46855.exe
        8⤵
        
        PID:15700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63337.exe
        8⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37952.exe
        7⤵
        
        PID:7604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62102.exe
        8⤵
        
        PID:12300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15583.exe
        7⤵
        
        PID:12956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34453.exe
        7⤵
        
        PID:16912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3708.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42313.exe
        7⤵
        
        PID:6668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55113.exe
        8⤵
        
        PID:9056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27593.exe
        9⤵
        
        PID:12536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27073.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9356.exe
        8⤵
        
        PID:12228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63396.exe
        8⤵
        
        PID:16900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        8⤵
        
        PID:6404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19887.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54519.exe
        7⤵
        
        PID:12684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46183.exe
        6⤵
        
        PID:7096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5253.exe
        7⤵
        
        PID:8968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10149.exe
        8⤵
        
        PID:15716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58743.exe
        7⤵
        
        PID:13520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        7⤵
        
        PID:16320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21423.exe
        6⤵
        
        PID:8568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35574.exe
        6⤵
        
        PID:11596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21838.exe
        6⤵
        
        PID:17012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31455.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47673.exe
        6⤵
        
        PID:2272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50377.exe
        7⤵
        
        PID:5868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49913.exe
        8⤵
        
        PID:6412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19769.exe
        9⤵
        
        PID:10136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55309.exe
        9⤵
        
        PID:12616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
        9⤵
        
        PID:17032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33743.exe
        8⤵
        
        PID:7248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37924.exe
        8⤵
        
        PID:15004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
        8⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60157.exe
        7⤵
        
        PID:9808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39799.exe
        7⤵
        
        PID:13784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46363.exe
        7⤵
        
        PID:16488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14367.exe
        6⤵
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36281.exe
        7⤵
        
        PID:8500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53737.exe
        8⤵
        
        PID:14384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38343.exe
        8⤵
        
        PID:16688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9356.exe
        7⤵
        
        PID:12212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63396.exe
        7⤵
        
        PID:16856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42839.exe
        6⤵
        
        PID:8244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22813.exe
        6⤵
        
        PID:13156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-230.exe
        5⤵
        
        PID:4024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46153.exe
        6⤵
        
        PID:6808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45990.exe
        7⤵
        
        PID:6156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23087.exe
        7⤵
        
        PID:11688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11699.exe
        7⤵
        
        PID:16524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        7⤵
        
        PID:17300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41023.exe
        6⤵
        
        PID:7984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54137.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63337.exe
        7⤵
        
        PID:17328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62884.exe
        6⤵
        
        PID:11320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51965.exe
        6⤵
        
        PID:17116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47645.exe
        5⤵
        
        PID:6712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59782.exe
        6⤵
        
        PID:10004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28908.exe
        6⤵
        
        PID:16364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
        6⤵
        
        PID:1340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5955.exe
        5⤵
        
        PID:9436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18588.exe
        5⤵
        
        PID:14616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58121.exe
        5⤵
        
        PID:5196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61145.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61145.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12104.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45561.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33574.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15320.exe
        8⤵
        
        PID:2252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53609.exe
        9⤵
        
        PID:9744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16870.exe
        9⤵
        
        PID:16160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55805.exe
        9⤵
        
        PID:3360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19820.exe
        8⤵
        
        PID:10156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8511.exe
        8⤵
        
        PID:16332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60157.exe
        7⤵
        
        PID:9824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57510.exe
        8⤵
        
        PID:16196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29880.exe
        8⤵
        
        PID:15688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39799.exe
        7⤵
        
        PID:13792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46363.exe
        7⤵
        
        PID:16712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12831.exe
        6⤵
        
        PID:5460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56649.exe
        7⤵
        
        PID:7528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16268.exe
        7⤵
        
        PID:10556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59556.exe
        7⤵
        
        PID:16004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        7⤵
        
        PID:17296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37952.exe
        6⤵
        
        PID:7716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35574.exe
        6⤵
        
        PID:12320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5118.exe
        6⤵
        
        PID:16696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58121.exe
        6⤵
        
        PID:14900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25887.exe
        5⤵
        Executes dropped EXE
        
        PID:2232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-901.exe
        6⤵
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56649.exe
        7⤵
        
        PID:7520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49097.exe
        8⤵
        
        PID:11224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36492.exe
        8⤵
        
        PID:16236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51696.exe
        8⤵
        
        PID:4516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16652.exe
        7⤵
        
        PID:3524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57510.exe
        8⤵
        
        PID:15972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10545.exe
        8⤵
        
        PID:4988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36772.exe
        7⤵
        
        PID:14808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32086.exe
        6⤵
        
        PID:9028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18204.exe
        6⤵
        
        PID:14776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58121.exe
        6⤵
        
        PID:16536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59924.exe
        5⤵
        
        PID:5512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51833.exe
        6⤵
        
        PID:6932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6632.exe
        7⤵
        
        PID:13232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63337.exe
        7⤵
        
        PID:6436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37884.exe
        6⤵
        
        PID:10400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22163.exe
        6⤵
        
        PID:15224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36237.exe
        6⤵
        
        PID:15344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63337.exe
        6⤵
        
        PID:6096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59456.exe
        5⤵
        
        PID:8148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51718.exe
        6⤵
        
        PID:2404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7160.exe
        7⤵
        
        PID:15648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63337.exe
        7⤵
        
        PID:5716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21228.exe
        6⤵
        
        PID:17316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14015.exe
        6⤵
        
        PID:16748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6.exe
        5⤵
        
        PID:11404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23308.exe
        5⤵
        
        PID:14888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29053.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29053.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47865.exe
        5⤵
        
        PID:4768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32806.exe
        6⤵
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4184.exe
        7⤵
        
        PID:8956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9356.exe
        7⤵
        
        PID:12128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63396.exe
        7⤵
        
        PID:16892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        7⤵
        
        PID:5672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3468.exe
        6⤵
        
        PID:9208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61734.exe
        7⤵
        
        PID:14956
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14956 -s 640
        8⤵
        Program crash
        
        PID:17388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38375.exe
        6⤵
        
        PID:12352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46457.exe
        6⤵
        
        PID:208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30895.exe
        5⤵
        
        PID:5984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36415.exe
        6⤵
        
        PID:9424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54519.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12357.exe
        6⤵
        
        PID:17292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1059.exe
        5⤵
        
        PID:8900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18204.exe
        5⤵
        
        PID:15156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58361.exe
        5⤵
        
        PID:15112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5878.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5878.exe
      4⤵
      PID:1460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16662.exe
        5⤵
        
        PID:5952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39846.exe
        6⤵
        
        PID:9068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39527.exe
        6⤵
        
        PID:13424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29737.exe
        6⤵
        
        PID:17064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58487.exe
        6⤵
        
        PID:17028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51792.exe
        5⤵
        
        PID:8872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47312.exe
        6⤵
        
        PID:15768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8495.exe
        5⤵
        
        PID:13356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        5⤵
        
        PID:5620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24527.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24527.exe
      4⤵
      PID:6196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50982.exe
        5⤵
        
        PID:6308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59369.exe
        6⤵
        
        PID:9632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
        6⤵
        
        PID:14268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18534.exe
        6⤵
        
        PID:16824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35196.exe
        5⤵
        
        PID:10300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22163.exe
        5⤵
        
        PID:15252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63337.exe
        5⤵
        
        PID:6376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47865.exe
      4⤵
      PID:7744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49865.exe
        5⤵
        
        PID:11084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50608.exe
        5⤵
        
        PID:15832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56791.exe
        5⤵
        
        PID:2536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36078.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36078.exe
      4⤵
      PID:11156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5716.exe
      4⤵
      PID:16052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62770.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62770.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3274.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3274.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47766.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36246.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49017.exe
        7⤵
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36153.exe
        8⤵
        
        PID:6264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15320.exe
        9⤵
        
        PID:1016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65401.exe
        10⤵
        
        PID:16692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29880.exe
        10⤵
        
        PID:17040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63252.exe
        9⤵
        
        PID:11248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56093.exe
        9⤵
        
        PID:16244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63337.exe
        9⤵
        
        PID:1920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57364.exe
        8⤵
        
        PID:7544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29880.exe
        9⤵
        
        PID:2148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4364.exe
        8⤵
        
        PID:12516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2262.exe
        8⤵
        
        PID:17064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50496.exe
        7⤵
        
        PID:6424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65533.exe
        8⤵
        
        PID:7232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7871.exe
        9⤵
        
        PID:17296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63337.exe
        9⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36823.exe
        8⤵
        
        PID:11584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49744.exe
        8⤵
        
        PID:16428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6080.exe
        8⤵
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22646.exe
        7⤵
        
        PID:7560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28377.exe
        8⤵
        
        PID:14944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62573.exe
        8⤵
        
        PID:16540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35746.exe
        8⤵
        
        PID:2536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42688.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60112.exe
        7⤵
        
        PID:16568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25398.exe
        7⤵
        
        PID:16756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2255.exe
        6⤵
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10216.exe
        7⤵
        
        PID:6652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40313.exe
        8⤵
        
        PID:7500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26534.exe
        9⤵
        
        PID:11284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28908.exe
        9⤵
        
        PID:16232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14481.exe
        9⤵
        
        PID:10012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45760.exe
        8⤵
        
        PID:11216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34851.exe
        8⤵
        
        PID:16032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        8⤵
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56768.exe
        7⤵
        
        PID:8124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2325.exe
        8⤵
        
        PID:12052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
        8⤵
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3190.exe
        7⤵
        
        PID:11328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48509.exe
        7⤵
        
        PID:16224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62711.exe
        6⤵
        
        PID:7136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37433.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14515.exe
        8⤵
        
        PID:15632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63337.exe
        8⤵
        
        PID:5220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9356.exe
        7⤵
        
        PID:12204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48708.exe
        7⤵
        
        PID:16836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
        7⤵
        
        PID:2440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55248.exe
        6⤵
        
        PID:8912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3779.exe
        6⤵
        
        PID:10976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14261.exe
        6⤵
        
        PID:17304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4945.exe
        6⤵
        
        PID:2220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15996.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32873.exe
        6⤵
        
        PID:32
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36262.exe
        7⤵
        
        PID:6312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54345.exe
        8⤵
        
        PID:8652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9356.exe
        8⤵
        
        PID:12244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63012.exe
        8⤵
        
        PID:17000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50144.exe
        8⤵
        
        PID:17104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19119.exe
        7⤵
        
        PID:8812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7016.exe
        8⤵
        
        PID:13100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27611.exe
        8⤵
        
        PID:4220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6579.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50496.exe
        6⤵
        
        PID:6416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28409.exe
        7⤵
        
        PID:7968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29305.exe
        8⤵
        
        PID:11812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29375.exe
        8⤵
        
        PID:16692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
        8⤵
        
        PID:6344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49149.exe
        7⤵
        
        PID:11296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46100.exe
        7⤵
        
        PID:17108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        7⤵
        
        PID:5448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18438.exe
        6⤵
        
        PID:9764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24838.exe
        7⤵
        
        PID:16080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12294.exe
        7⤵
        
        PID:16852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15516.exe
        6⤵
        
        PID:13584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59051.exe
        6⤵
        
        PID:16672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15990.exe
        5⤵
        
        PID:5236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21945.exe
        6⤵
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31305.exe
        7⤵
        
        PID:8240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16870.exe
        7⤵
        
        PID:16168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        7⤵
        
        PID:5780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60941.exe
        6⤵
        
        PID:8752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22736.exe
        6⤵
        
        PID:16108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29190.exe
        6⤵
        
        PID:17260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6080.exe
        6⤵
        
        PID:4724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52253.exe
        5⤵
        
        PID:7204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26918.exe
        6⤵
        
        PID:10272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28908.exe
        6⤵
        
        PID:14924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
        6⤵
        
        PID:5764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65047.exe
        5⤵
        
        PID:10584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5983.exe
        5⤵
        
        PID:15396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59819.exe
        5⤵
        
        PID:15480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27900.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27900.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21254.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23657.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19641.exe
        7⤵
        
        PID:7120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4184.exe
        8⤵
        
        PID:8948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27080.exe
        9⤵
        
        PID:16840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48080.exe
        8⤵
        
        PID:11352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43609.exe
        9⤵
        
        PID:4620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46100.exe
        8⤵
        
        PID:17124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26303.exe
        8⤵
        
        PID:4352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61687.exe
        7⤵
        
        PID:8036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42237.exe
        7⤵
        
        PID:13404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13135.exe
        6⤵
        
        PID:6704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16150.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12166.exe
        7⤵
        
        PID:17072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57789.exe
        6⤵
        
        PID:10952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37622.exe
        6⤵
        
        PID:15680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7164.exe
        5⤵
        
        PID:5600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20985.exe
        6⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4184.exe
        7⤵
        
        PID:8940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24623.exe
        7⤵
        
        PID:12100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46868.exe
        7⤵
        
        PID:16788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        7⤵
        
        PID:5364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34495.exe
        6⤵
        
        PID:9236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38375.exe
        6⤵
        
        PID:12360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60045.exe
        6⤵
        
        PID:17108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        6⤵
        
        PID:6384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29859.exe
        5⤵
        
        PID:7276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-472.exe
        6⤵
        
        PID:11256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26687.exe
        6⤵
        
        PID:15708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
        6⤵
        
        PID:5768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8175.exe
        5⤵
        
        PID:10592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22518.exe
        5⤵
        
        PID:15384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13670.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13670.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43174.exe
        5⤵
        
        PID:5540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6677.exe
        6⤵
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37049.exe
        7⤵
        
        PID:8980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25302.exe
        7⤵
        
        PID:13532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7580.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62756.exe
        6⤵
        
        PID:7608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42237.exe
        6⤵
        
        PID:13324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64448.exe
        5⤵
        
        PID:7224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42841.exe
        6⤵
        
        PID:9640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
        6⤵
        
        PID:14352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10545.exe
        6⤵
        
        PID:4276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17110.exe
        5⤵
        
        PID:10428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21862.exe
        5⤵
        
        PID:15432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        5⤵
        
        PID:5628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43568.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43568.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40998.exe
        5⤵
        
        PID:7868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55034.exe
        6⤵
        
        PID:13152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19507.exe
        6⤵
        
        PID:16440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27611.exe
        6⤵
        
        PID:2548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64592.exe
        5⤵
        
        PID:10396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58404.exe
        5⤵
        
        PID:15488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28995.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28995.exe
      4⤵
      PID:9000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16134.exe
        5⤵
        
        PID:16876
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16876 -s 80
        6⤵
        Program crash
        
        PID:17180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42479.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42479.exe
      4⤵
      PID:11072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60742.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60742.exe
      4⤵
      PID:17024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49718.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49718.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31622.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31622.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18265.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15961.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35385.exe
        7⤵
        
        PID:6352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1823.exe
        8⤵
        
        PID:8616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9528.exe
        9⤵
        
        PID:12760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63337.exe
        9⤵
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38375.exe
        8⤵
        
        PID:12340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        8⤵
        
        PID:17404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34495.exe
        7⤵
        
        PID:8648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8495.exe
        7⤵
        
        PID:12292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58960.exe
        6⤵
        
        PID:6860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3432.exe
        7⤵
        
        PID:10196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1388.exe
        8⤵
        
        PID:13052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22252.exe
        7⤵
        
        PID:9304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42660.exe
        7⤵
        
        PID:15108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51997.exe
        7⤵
        
        PID:17020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45927.exe
        6⤵
        
        PID:10160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24640.exe
        6⤵
        
        PID:11132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36271.exe
        5⤵
        
        PID:5432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54150.exe
        6⤵
        
        PID:7060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37926.exe
        7⤵
        
        PID:8904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16145.exe
        8⤵
        
        PID:3196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9356.exe
        7⤵
        
        PID:12260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63396.exe
        7⤵
        
        PID:16916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45632.exe
        6⤵
        
        PID:8272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7347.exe
        6⤵
        
        PID:13172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3631.exe
        6⤵
        
        PID:16740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-745.exe
        6⤵
        
        PID:3432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43975.exe
        5⤵
        
        PID:6604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30921.exe
        6⤵
        
        PID:7992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16870.exe
        6⤵
        
        PID:16152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        6⤵
        
        PID:5184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38269.exe
        5⤵
        
        PID:10260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36659.exe
        5⤵
        
        PID:15040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49931.exe
        5⤵
        
        PID:16612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30687.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30687.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15961.exe
        5⤵
        
        PID:1168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53065.exe
        6⤵
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28409.exe
        7⤵
        
        PID:8012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28153.exe
        8⤵
        
        PID:10044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49277.exe
        8⤵
        
        PID:16980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
        8⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49149.exe
        7⤵
        
        PID:11240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46100.exe
        7⤵
        
        PID:17140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        7⤵
        
        PID:14904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4703.exe
        6⤵
        
        PID:9772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9651.exe
        6⤵
        
        PID:13596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        6⤵
        
        PID:1048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24566.exe
        5⤵
        
        PID:6920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51673.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-108.exe
        7⤵
        
        PID:16760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7343.exe
        6⤵
        
        PID:13604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44139.exe
        6⤵
        
        PID:16684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53344.exe
        5⤵
        
        PID:396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35123.exe
        5⤵
        
        PID:14608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17059.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17059.exe
      4⤵
      PID:5248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3039.exe
        5⤵
        
        PID:6272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60806.exe
        6⤵
        
        PID:9844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41945.exe
        7⤵
        
        PID:16280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10545.exe
        7⤵
        
        PID:4240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28863.exe
        6⤵
        
        PID:13816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
        6⤵
        
        PID:5312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56311.exe
        5⤵
        
        PID:3656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14070.exe
        5⤵
        
        PID:16128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3039.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3039.exe
      4⤵
      PID:7148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30246.exe
        5⤵
        
        PID:7192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4364.exe
        5⤵
        
        PID:12876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29203.exe
        5⤵
        
        PID:17128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41687.exe
        5⤵
        
        PID:16676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14486.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14486.exe
      4⤵
      PID:9388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51520.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51520.exe
      4⤵
      PID:12764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22639.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22639.exe
      4⤵
      PID:16800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47885.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47885.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53542.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53542.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23190.exe
        5⤵
        
        PID:5224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19641.exe
        6⤵
        
        PID:7160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6120.exe
        7⤵
        
        PID:8268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24639.exe
        7⤵
        
        PID:13012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28239.exe
        7⤵
        
        PID:17068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44139.exe
        7⤵
        
        PID:16768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30182.exe
        6⤵
        
        PID:9724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43789.exe
        6⤵
        
        PID:14664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        6⤵
        
        PID:5692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14204.exe
        5⤵
        
        PID:6684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23801.exe
        6⤵
        
        PID:9292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57120.exe
        6⤵
        
        PID:12748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
        6⤵
        
        PID:5836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47764.exe
        5⤵
        
        PID:9616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51168.exe
        5⤵
        
        PID:14288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14360.exe
        5⤵
        
        PID:724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53568.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53568.exe
      4⤵
      PID:5336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55769.exe
        5⤵
        
        PID:6148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4117.exe
        6⤵
        
        PID:8760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21567.exe
        6⤵
        
        PID:13340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
        6⤵
        
        PID:5256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60557.exe
        5⤵
        
        PID:8664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37924.exe
        5⤵
        
        PID:14644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
        5⤵
        
        PID:5700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50135.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50135.exe
      4⤵
      PID:7756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60649.exe
        5⤵
        
        PID:11068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63337.exe
        5⤵
        
        PID:6060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10582.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10582.exe
      4⤵
      PID:12572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51264.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51264.exe
      4⤵
      PID:17096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60042.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:15740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28467.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28467.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26646.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26646.exe
      4⤵
      PID:5736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40998.exe
        5⤵
        
        PID:7876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41049.exe
        6⤵
        
        PID:14304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28924.exe
        6⤵
        
        PID:17096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-508.exe
        5⤵
        
        PID:4260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50228.exe
        5⤵
        
        PID:16268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1231.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1231.exe
      4⤵
      PID:8848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16284.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16284.exe
      4⤵
      PID:13464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2031.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2031.exe
    3⤵
    PID:6040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40998.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40998.exe
      4⤵
      PID:7852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46144.exe
        5⤵
        
        PID:9680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59940.exe
        5⤵
        
        PID:2468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
        5⤵
        
        PID:4580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22892.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22892.exe
      4⤵
      PID:10548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23699.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23699.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:15200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62953.exe
      4⤵
      PID:1984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29033.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29033.exe
    3⤵
    PID:8828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64828.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64828.exe
    3⤵
    PID:12160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33191.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33191.exe
    3⤵
    PID:16816
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29697.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29697.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34312.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34312.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19611.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19611.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47465.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35478.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32873.exe
        7⤵
        
        PID:1216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20886.exe
        8⤵
        
        PID:6292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28409.exe
        9⤵
        
        PID:7956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29880.exe
        10⤵
        
        PID:16664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39527.exe
        9⤵
        
        PID:13432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        9⤵
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5855.exe
        8⤵
        
        PID:9560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41366.exe
        9⤵
        
        PID:16068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35746.exe
        9⤵
        
        PID:2892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56439.exe
        8⤵
        
        PID:13396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        8⤵
        
        PID:6396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9484.exe
        7⤵
        
        PID:6724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6120.exe
        8⤵
        
        PID:8788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58361.exe
        9⤵
        
        PID:14768
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8788 -s 720
        9⤵
        Program crash
        
        PID:17148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24639.exe
        8⤵
        
        PID:12944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
        8⤵
        
        PID:17072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13446.exe
        7⤵
        
        PID:10084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56441.exe
        8⤵
        
        PID:15988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10545.exe
        8⤵
        
        PID:1416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22720.exe
        7⤵
        
        PID:12652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53920.exe
        7⤵
        
        PID:16900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3708.exe
        6⤵
        
        PID:5160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38089.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31305.exe
        8⤵
        
        PID:8640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16870.exe
        8⤵
        
        PID:16284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11043.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58912.exe
        7⤵
        
        PID:3092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37924.exe
        7⤵
        
        PID:14688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33933.exe
        7⤵
        
        PID:15196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63337.exe
        7⤵
        
        PID:5664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29558.exe
        6⤵
        
        PID:1916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44761.exe
        7⤵
        
        PID:10032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
        7⤵
        
        PID:13320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28941.exe
        7⤵
        
        PID:15196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21046.exe
        7⤵
        
        PID:4068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55264.exe
        6⤵
        
        PID:10476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36742.exe
        6⤵
        
        PID:15036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14159.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22806.exe
        6⤵
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54150.exe
        7⤵
        
        PID:7052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4184.exe
        8⤵
        
        PID:8988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25302.exe
        8⤵
        
        PID:13512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        8⤵
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62756.exe
        7⤵
        
        PID:7612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42237.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46000.exe
        6⤵
        
        PID:6624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14136.exe
        7⤵
        
        PID:12968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63337.exe
        7⤵
        
        PID:5532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32403.exe
        6⤵
        
        PID:10252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45325.exe
        6⤵
        
        PID:15060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17526.exe
        5⤵
        
        PID:5468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24633.exe
        6⤵
        
        PID:6632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60806.exe
        7⤵
        
        PID:9852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44836.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
        7⤵
        
        PID:5644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42575.exe
        6⤵
        
        PID:2040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22736.exe
        6⤵
        
        PID:16308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58308.exe
        6⤵
        
        PID:11104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        6⤵
        
        PID:5688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41776.exe
        5⤵
        
        PID:8044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10675.exe
        5⤵
        
        PID:10496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21087.exe
        5⤵
        
        PID:15632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16503.exe
        5⤵
        
        PID:17360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43359.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43359.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50553.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15961.exe
        6⤵
        
        PID:3804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36729.exe
        7⤵
        
        PID:6504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40313.exe
        8⤵
        
        PID:7492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12280.exe
        9⤵
        
        PID:8896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16870.exe
        9⤵
        
        PID:16120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51296.exe
        9⤵
        
        PID:16724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8229.exe
        9⤵
        
        PID:16244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16652.exe
        8⤵
        
        PID:10288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36772.exe
        8⤵
        
        PID:14820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8911.exe
        7⤵
        
        PID:7468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56249.exe
        8⤵
        
        PID:16216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21555.exe
        7⤵
        
        PID:11912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35136.exe
        7⤵
        
        PID:16724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32447.exe
        6⤵
        
        PID:7088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6488.exe
        7⤵
        
        PID:9032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39062.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10545.exe
        8⤵
        
        PID:4824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31.exe
        7⤵
        
        PID:12308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17187.exe
        7⤵
        
        PID:16656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57119.exe
        7⤵
        
        PID:16660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19123.exe
        6⤵
        
        PID:9008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65519.exe
        7⤵
        
        PID:3492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18204.exe
        6⤵
        
        PID:14756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26265.exe
        6⤵
        
        PID:15716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53152.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4476.exe
        5⤵
        
        PID:5524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38089.exe
        6⤵
        
        PID:6236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24086.exe
        7⤵
        
        PID:9212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9356.exe
        7⤵
        
        PID:12172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62327.exe
        7⤵
        
        PID:16836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6080.exe
        7⤵
        
        PID:1752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5855.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63337.exe
        7⤵
        
        PID:16516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42599.exe
        6⤵
        
        PID:13800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        6⤵
        
        PID:6432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20063.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14136.exe
        6⤵
        
        PID:12976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53808.exe
        6⤵
        
        PID:16320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27073.exe
        6⤵
        
        PID:1252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20291.exe
        5⤵
        
        PID:12152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44060.exe
        5⤵
        
        PID:16872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59274.exe
        5⤵
        
        PID:2824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27894.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27894.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40953.exe
        5⤵
        
        PID:5840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56649.exe
        6⤵
        
        PID:7572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13382.exe
        6⤵
        
        PID:12564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10927.exe
        6⤵
        
        PID:15108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32086.exe
        5⤵
        
        PID:9020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37772.exe
        6⤵
        
        PID:15764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36423.exe
        6⤵
        
        PID:15712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27080.exe
        6⤵
        
        PID:1864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65367.exe
        5⤵
        
        PID:5088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42992.exe
      4⤵
      PID:6080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48185.exe
        5⤵
        
        PID:5272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13077.exe
        6⤵
        
        PID:12192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49661.exe
        6⤵
        
        PID:16880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
        6⤵
        
        PID:6444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18751.exe
        5⤵
        
        PID:3120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36087.exe
        5⤵
        
        PID:14824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
        5⤵
        
        PID:5452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21792.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21792.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35746.exe
        5⤵
        
        PID:16904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17487.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17487.exe
      4⤵
      PID:11600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8936.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8936.exe
      4⤵
      PID:16480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-745.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-745.exe
      4⤵
      PID:3456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35982.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35982.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62841.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62841.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3656.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9733.exe
        6⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35907.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3093.exe
        8⤵
        
        PID:11824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
        8⤵
        
        PID:3472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17599.exe
        7⤵
        
        PID:7584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39460.exe
        7⤵
        
        PID:15100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
        7⤵
        
        PID:6100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44890.exe
        6⤵
        
        PID:9864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39799.exe
        6⤵
        
        PID:13776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57709.exe
        5⤵
        
        PID:5960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56649.exe
        6⤵
        
        PID:7696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12709.exe
        7⤵
        
        PID:12636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45760.exe
        6⤵
        
        PID:10340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1878.exe
        6⤵
        
        PID:14896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47447.exe
        5⤵
        
        PID:8720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44224.exe
        5⤵
        
        PID:12080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42999.exe
        5⤵
        
        PID:16744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1004.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1004.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10501.exe
        5⤵
        
        PID:5580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21945.exe
        6⤵
        
        PID:6280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61657.exe
        7⤵
        
        PID:7996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6632.exe
        8⤵
        
        PID:13240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25302.exe
        7⤵
        
        PID:13540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        7⤵
        
        PID:16976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38719.exe
        6⤵
        
        PID:9600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56439.exe
        6⤵
        
        PID:13388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31081.exe
        6⤵
        
        PID:11104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        6⤵
        
        PID:17004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32652.exe
        5⤵
        
        PID:7196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17769.exe
        6⤵
        
        PID:11116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18812.exe
        6⤵
        
        PID:15940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56775.exe
        6⤵
        
        PID:15480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
        6⤵
        
        PID:5748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19030.exe
        5⤵
        
        PID:10512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29565.exe
        5⤵
        
        PID:14588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
        5⤵
        
        PID:5668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37703.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37703.exe
      4⤵
      PID:6024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40998.exe
        5⤵
        
        PID:7860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9528.exe
        6⤵
        
        PID:12900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22883.exe
        6⤵
        
        PID:17048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-508.exe
        5⤵
        
        PID:8256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30406.exe
        5⤵
        
        PID:16536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-745.exe
        5⤵
        
        PID:16964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20831.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20831.exe
      4⤵
      PID:8864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42601.exe
        5⤵
        
        PID:14832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27080.exe
        5⤵
        
        PID:2916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20291.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20291.exe
      4⤵
      PID:12180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42991.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42991.exe
      4⤵
      PID:16828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13856.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13856.exe
      4⤵
      PID:5124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41636.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41636.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3272.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3272.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10501.exe
        5⤵
        
        PID:5572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5525.exe
        6⤵
        
        PID:7008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5253.exe
        7⤵
        
        PID:9148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9356.exe
        7⤵
        
        PID:12268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63396.exe
        7⤵
        
        PID:16908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58487.exe
        7⤵
        
        PID:4492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1823.exe
        6⤵
        
        PID:8596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27073.exe
        7⤵
        
        PID:16232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8495.exe
        6⤵
        
        PID:13376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15356.exe
        5⤵
        
        PID:5852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59369.exe
        6⤵
        
        PID:10092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2227.exe
        5⤵
        
        PID:10364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18783.exe
        5⤵
        
        PID:16512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6012.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6012.exe
      4⤵
      PID:5872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8709.exe
        5⤵
        
        PID:7688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25417.exe
        6⤵
        
        PID:16784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27080.exe
        6⤵
        
        PID:1248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15775.exe
        5⤵
        
        PID:9624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51764.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44139.exe
        5⤵
        
        PID:4924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65044.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65044.exe
      4⤵
      PID:8800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22009.exe
        5⤵
        
        PID:13188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6815.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7619.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7619.exe
      4⤵
      PID:13448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46655.exe
      4⤵
      PID:16320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52400.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52400.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25193.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25193.exe
      4⤵
      PID:5812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56649.exe
        5⤵
        
        PID:7536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59216.exe
        5⤵
        
        PID:10768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46855.exe
        5⤵
        
        PID:15692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63337.exe
        5⤵
        
        PID:6440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32086.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32086.exe
      4⤵
      PID:9076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44240.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44240.exe
      4⤵
      PID:11316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45319.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45319.exe
      4⤵
      PID:17368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3107.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3107.exe
    3⤵
    PID:5944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15320.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15320.exe
      4⤵
      PID:7016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59753.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
        5⤵
        
        PID:12316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20015.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20015.exe
      4⤵
      PID:11292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18406.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18406.exe
      4⤵
      PID:15484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52320.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52320.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19285.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19285.exe
    3⤵
    PID:11716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19310.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19310.exe
    3⤵
    PID:16656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43345.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43345.exe
    3⤵
    PID:17076
- C:\Users\Admin\AppData\Local\Temp\Unicorn-58031.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-58031.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29345.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29345.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26329.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26329.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55161.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12037.exe
        6⤵
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56649.exe
        7⤵
        
        PID:7628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28377.exe
        8⤵
        
        PID:14964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29231.exe
        7⤵
        
        PID:11188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34851.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58487.exe
        7⤵
        
        PID:60
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33711.exe
        6⤵
        
        PID:8728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9637.exe
        7⤵
        
        PID:13004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44576.exe
        7⤵
        
        PID:4564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63337.exe
        7⤵
        
        PID:1112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23091.exe
        6⤵
        
        PID:6800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3340.exe
        6⤵
        
        PID:17008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57325.exe
        5⤵
        
        PID:4320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-712.exe
        6⤵
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62953.exe
        7⤵
        
        PID:1100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3759.exe
        6⤵
        
        PID:10328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22163.exe
        6⤵
        
        PID:15260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62953.exe
        6⤵
        
        PID:16340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6118.exe
        5⤵
        
        PID:7188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38150.exe
        6⤵
        
        PID:9676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24188.exe
        6⤵
        
        PID:14696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42759.exe
        6⤵
        
        PID:15804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30576.exe
        5⤵
        
        PID:10676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37894.exe
        5⤵
        
        PID:15640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2623.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2623.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25193.exe
        5⤵
        
        PID:5820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49062.exe
        6⤵
        
        PID:6976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56665.exe
        7⤵
        
        PID:9308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57120.exe
        7⤵
        
        PID:12664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11043.exe
        7⤵
        
        PID:16648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17583.exe
        6⤵
        
        PID:8576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52516.exe
        6⤵
        
        PID:13420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        6⤵
        
        PID:5204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26124.exe
        5⤵
        
        PID:2464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29513.exe
        6⤵
        
        PID:13364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28630.exe
        6⤵
        
        PID:14924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21555.exe
        5⤵
        
        PID:11748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48976.exe
        5⤵
        
        PID:16648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37319.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37319.exe
      4⤵
      PID:4884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-712.exe
        5⤵
        
        PID:5744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11896.exe
        6⤵
        
        PID:9996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
        6⤵
        
        PID:4600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63337.exe
        6⤵
        
        PID:15404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16175.exe
        5⤵
        
        PID:13736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43120.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43120.exe
      4⤵
      PID:8168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44121.exe
        5⤵
        
        PID:12908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63337.exe
        5⤵
        
        PID:1528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6.exe
      4⤵
      PID:11396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38767.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38767.exe
      4⤵
      PID:14792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21267.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21267.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56230.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56230.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43833.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20630.exe
        6⤵
        
        PID:8620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20006.exe
        7⤵
        
        PID:12640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56864.exe
        7⤵
        
        PID:17104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9356.exe
        6⤵
        
        PID:12220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63012.exe
        6⤵
        
        PID:17040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17087.exe
        6⤵
        
        PID:16720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        6⤵
        
        PID:17348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63613.exe
        5⤵
        
        PID:8440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16678.exe
        6⤵
        
        PID:16100
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8440 -s 656
        6⤵
        Program crash
        
        PID:13732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16838.exe
        5⤵
        
        PID:13020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3631.exe
        5⤵
        
        PID:16864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24867.exe
        5⤵
        
        PID:16964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56256.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56256.exe
      4⤵
      PID:6108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7640.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19990.exe
        6⤵
        
        PID:9644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28908.exe
        6⤵
        
        PID:16140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
        6⤵
        
        PID:4296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13382.exe
        5⤵
        
        PID:12556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31110.exe
      4⤵
      PID:8744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28957.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28957.exe
      4⤵
      PID:9248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60212.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60212.exe
      4⤵
      PID:17016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23293.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23293.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25878.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25878.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-712.exe
        5⤵
        
        PID:3408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1624.exe
        6⤵
        
        PID:10964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12463.exe
        6⤵
        
        PID:15764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63337.exe
        6⤵
        
        PID:5356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20102.exe
        5⤵
        
        PID:11112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65421.exe
        5⤵
        
        PID:16276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24671.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24671.exe
      4⤵
      PID:7704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21555.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21555.exe
      4⤵
      PID:11920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51664.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51664.exe
      4⤵
      PID:16772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2723.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2723.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31465.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31465.exe
      4⤵
      PID:6464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33145.exe
        5⤵
        
        PID:10528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38028.exe
        5⤵
        
        PID:15068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14481.exe
        5⤵
        
        PID:2376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18668.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18668.exe
      4⤵
      PID:10276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54151.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54151.exe
      4⤵
      PID:15088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
      4⤵
      PID:5328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51936.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51936.exe
    3⤵
    PID:8052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26918.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26918.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28908.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28908.exe
      4⤵
      PID:14988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
      4⤵
      PID:5640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19285.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19285.exe
    3⤵
    PID:11904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20379.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20379.exe
    3⤵
    PID:16684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56474.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56474.exe
    3⤵
    PID:15196
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3009.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3009.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47766.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47766.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37782.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37782.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10501.exe
        5⤵
        
        PID:5588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22905.exe
        6⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13717.exe
        7⤵
        
        PID:8040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55942.exe
        8⤵
        
        PID:13208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53991.exe
        8⤵
        
        PID:1148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63337.exe
        8⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58743.exe
        7⤵
        
        PID:13500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28607.exe
        7⤵
        
        PID:14924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        7⤵
        
        PID:724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3078.exe
        6⤵
        
        PID:9748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54925.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2671.exe
        6⤵
        
        PID:15716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        6⤵
        
        PID:6092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4303.exe
        5⤵
        
        PID:7724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26697.exe
        6⤵
        
        PID:9652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10545.exe
        7⤵
        
        PID:1748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31567.exe
        6⤵
        
        PID:13288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36516.exe
        6⤵
        
        PID:17044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17494.exe
        5⤵
        
        PID:10320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28029.exe
        5⤵
        
        PID:15232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42839.exe
        5⤵
        
        PID:4680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22540.exe
      4⤵
      PID:5772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-712.exe
        5⤵
        
        PID:1704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12965.exe
        6⤵
        
        PID:10024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
        6⤵
        
        PID:7024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27872.exe
        6⤵
        
        PID:15808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63337.exe
        6⤵
        
        PID:15804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29231.exe
        5⤵
        
        PID:11260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6118.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6118.exe
      4⤵
      PID:448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51417.exe
        5⤵
        
        PID:11324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49277.exe
        5⤵
        
        PID:17032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42688.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42688.exe
      4⤵
      PID:11672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8899.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8899.exe
      4⤵
      PID:16576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63901.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63901.exe
      4⤵
      PID:16976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17532.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17532.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42348.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42348.exe
      4⤵
      PID:6744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38777.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39497.exe
        6⤵
        
        PID:12892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-175.exe
        6⤵
        
        PID:17172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27667.exe
        6⤵
        
        PID:16932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21644.exe
        6⤵
        
        PID:2172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27080.exe
        6⤵
        
        PID:15636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9356.exe
        5⤵
        
        PID:12236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13235.exe
        5⤵
        
        PID:17088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18355.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18355.exe
      4⤵
      PID:9404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41433.exe
        5⤵
        
        PID:13828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28924.exe
        5⤵
        
        PID:16680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60384.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60384.exe
      4⤵
      PID:12704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5523.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5523.exe
    3⤵
    PID:216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33001.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33001.exe
      4⤵
      PID:6708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42036.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42036.exe
      4⤵
      PID:14312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28512.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28512.exe
    3⤵
    PID:7548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40681.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40681.exe
      4⤵
      PID:15740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34022.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34022.exe
    3⤵
    PID:11616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57901.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57901.exe
    3⤵
    PID:16584
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38836.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38836.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21254.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21254.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7512.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7512.exe
      4⤵
      PID:5372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20639.exe
        5⤵
        
        PID:7708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48889.exe
        6⤵
        
        PID:15768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30264.exe
        6⤵
        
        PID:16792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59028.exe
        5⤵
        
        PID:10996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38112.exe
        5⤵
        
        PID:15812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53991.exe
        5⤵
        
        PID:17304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4303.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4303.exe
      4⤵
      PID:7732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29510.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29510.exe
      4⤵
      PID:3364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57629.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57629.exe
      4⤵
      PID:14764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11036.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11036.exe
      4⤵
      PID:17280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3791.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3791.exe
    3⤵
    PID:5492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31849.exe
      4⤵
      PID:1548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20665.exe
        5⤵
        
        PID:13084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27611.exe
        5⤵
        
        PID:5104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17599.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17599.exe
      4⤵
      PID:4608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56944.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56944.exe
      4⤵
      PID:14916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44183.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44183.exe
      4⤵
      PID:11104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
      4⤵
      PID:5300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23715.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23715.exe
    3⤵
    PID:7512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59389.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59389.exe
      4⤵
      PID:3612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27421.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27421.exe
    3⤵
    PID:11892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40311.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40311.exe
    3⤵
    PID:16700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57353.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57353.exe
    3⤵
    PID:17292
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27199.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27199.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25193.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25193.exe
    3⤵
    PID:5804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35222.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35222.exe
      4⤵
      PID:5832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10168.exe
        5⤵
        
        PID:9792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63337.exe
        5⤵
        
        PID:5404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19635.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19635.exe
      4⤵
      PID:10580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52532.exe
      4⤵
      PID:16316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57353.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57353.exe
      4⤵
      PID:16740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57920.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57920.exe
    3⤵
    PID:7680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36823.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36823.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:11664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17564.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17564.exe
    3⤵
    PID:16532
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3253.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3253.exe
  2⤵
  PID:5128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-712.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-712.exe
    3⤵
    PID:5976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59753.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59753.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
      4⤵
      PID:6596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54029.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54029.exe
    3⤵
    PID:10356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22163.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22163.exe
    3⤵
    PID:15244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18639.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18639.exe
    3⤵
    PID:1400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63337.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63337.exe
    3⤵
    PID:15808
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47854.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47854.exe
  2⤵
  PID:6664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16969.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16969.exe
    3⤵
    PID:16780
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7687.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7687.exe
  2⤵
  PID:11656
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52300.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52300.exe
  2⤵
  PID:16552

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3536 -s 668
1⤵
PID:11104

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 608 -p 1340 -ip 1340
1⤵
PID:16100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 16040 -ip 16040
1⤵
PID:15720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11756.exe

Filesize
468KB

MD5
19e846d004e50421bf8cf44c2c50ff55

SHA1
4202c674bcd076f5dcbbd38c40b0794ead63aab4

SHA256
bd8f316aa1475b57e074fcdd48d991c36d987ed47a55ad36be07ce7ea7e97a82

SHA512
91bdd932aeec8a0519818dec3787af95545a5019a87e9717de790a54bf026ddc499d7d6ce0f0c83724c10efb392777841ed643b2ea58e06b9c6030c37a895dd6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12104.exe

Filesize
468KB

MD5
ad9c3b19661078fa0ceff07f97b6e2c2

SHA1
f3579386f925dd9bea1d4e453881c40bcb7b20e1

SHA256
032aec2c2f8557289aa4104850f07bdfab9bff1a03a2045fba3e5078692307f6

SHA512
55c48412c0c7528754a1c5eb3e8189b57990dd551fb68f88c826054214f62f8afdd980ad13546e4f06a81ed2cdeb8296d9d69edb86095c2daba59758b06b4bbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12789.exe

Filesize
468KB

MD5
f94fb9d33d71eb0e6caab93fc025d2d6

SHA1
5e1be8384e58d419b90a5f5e92405a24b8a702f8

SHA256
e0e70314de595b17320cc20778575f9addb74a9695f276485b508146856adf71

SHA512
562477d9a6786b9fb6e2f9f595516528e3ce7729f077728f024e3862844b74ec73a1e2fd29118a8f6bdd71a5759cba2dffa846b644ff455d6167ccb165edb2d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19611.exe

Filesize
468KB

MD5
2d16588a95f8344356d9ed6801a4c234

SHA1
f6c6106deca76228deef3119a6fc615810d90410

SHA256
6bba357884664c4cadf9c7a081950a3780ab2f40b879d909085e12e849dba556

SHA512
5cbab9a06d1a027a25745927ff905e0683dd83da3c0d527301dfd42bbe3f4a43244829354fee44e8c8ce45576c1e0ab1c008fc782ca25fc373db64a8eef9de31

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21267.exe

Filesize
468KB

MD5
69df67ef543e0f190979c97b0032f819

SHA1
a91d7d2fc1c4fae8cc45ed422005f8ebd24cf44d

SHA256
f34eeb3071b5bdae9811017a6eee20e510e96f8ad57a92441e7aab91e7f87312

SHA512
62c01c8d0f1cf7766bacdbdf5f36e8adca46922fd9e73dcd599b13349cae7668c240c6e3524576f6e936d093e85be0bc3161d701c7451efaa83251bbc1e9c8bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26329.exe

Filesize
468KB

MD5
e11958e453d8225debeaa60920053080

SHA1
93180c8beb7a6c9a9f9e637179bfb6845a85df87

SHA256
3f63f43337951aeaa946337cace5aad792002eea945f46b02af7809bf2b11aae

SHA512
f6e2dcb253950b89da044021084cb89731ce4bee22ec46f117a460698666031d1b3ac62e4b5806e35b6b8da2cc4320910cee0086c7dc9056e649cf82d27d9f26

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27900.exe

Filesize
468KB

MD5
d892aedf370745dbaa37f465b093ea22

SHA1
aa1b68bd1988b489dc6e00ca33c51369f431507b

SHA256
cf85274af0be5b6b7d88ab2b88294a9865db28cd39f1c3293112ae1b116eca3b

SHA512
dba8b510a0c3a94b4c0ae2fdcd64ceb5f2fa01d1b5a1c96fa9767a2b19e32eb215e965701d50f66b3ba135dc57fc94aa4964e28b71bf8de51f1b8e718778e6f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2807.exe

Filesize
468KB

MD5
470689e6a7ca38baedb2be9f7f5c9393

SHA1
6c34031b7db8d8cfcf6cecb8e5b905a74e433fb1

SHA256
145f05d6090876f102c9de1b54070a417c0628102ea836e472443e0cd7dbc4d1

SHA512
9f6a1cad4e53209ee9c8e0092144bba4f4f142d00fc5478e8fc6449457c458f1f10043392147e42369a89c2bdb5a58c62475fc920b7db4933f0070ebee7b34fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29345.exe

Filesize
468KB

MD5
b41b11486699eb01b735031a34fadb66

SHA1
28c8b2cf6a067f106f494e3c2137694f6e29e9a4

SHA256
b95aeeb583a092917954f57936404176a94a42c45e61bb78b16df2a191597d62

SHA512
a3d52ee5af21afcf8baefab135e9803fb7ed64af6188e5f4d46b13820b54038ccca445d75b2ed2e7f562caa5a1bf711f672e8dac05cfd0f94e203cb63953f7b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29697.exe

Filesize
468KB

MD5
a4bf408023745334273001a9da7d91c5

SHA1
9c654c9d978315736eda9afa34fd08cff7a8bddd

SHA256
c2d7b4a441f3be1b6bab9fc4ff8351577b4431c3b3dcc86d7e2ed852c5060815

SHA512
a6d58c2d5fb985c4fca82af82905de34aa68dca4a4e91e2d9f22079469013792ced6023706d64d461629c56ad5fe46623ee1faa253a835b8c8d38b0942af1a7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3009.exe

Filesize
468KB

MD5
8516225b672ae1ab50fadb649dfb6a8e

SHA1
ba8113d95c0d7e55267d2c93da53339046f355ef

SHA256
1ae6eb8b5f600303a1c9db29d846bc6d6281fb338beff0fe190fcc360d18a1b0

SHA512
1b6ac1f85ae973a2755a2aeee30823c66792f2f04beda01b06f8e79df889512c3650c9f7275f6f8aaeabea46010ae27b4858466ee0a361c3e6d05215e6d3fdb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30553.exe

Filesize
468KB

MD5
ef39e4aa51dce1ba9083dfefdf6aff52

SHA1
c74f26394d1ea7f7f308b3db2fe12a5f7ec15d93

SHA256
f03c784c359fd7e34470086cb50078385c861e15e76f2b5e82bc983428e4b001

SHA512
82a6a85fc25a2a3ced5e8152c62c78eeb2afb4b7aa34a4e8f8ad65ee6177aba86e068123318f798bbce25b1d301cf1d0be8e47e2917f74ef98fecb98004258e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31622.exe

Filesize
468KB

MD5
a2d342098a4525cbb644882da8ad640b

SHA1
8d0dad54ffa49686ae4522ed4cf6606ae80de05e

SHA256
56a7d1611d07ce2c7ebfadc686053cd30cff98f8ec060c288c2ad11a7d4c7044

SHA512
1d7030693883703b06bdfe617bb36e227cff259f48741c9b283a672b12ac3fe3f14434c4edb2dab6635855431fa16081d88c3dbe5a95623a81c5afd3afe87a88

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3274.exe

Filesize
468KB

MD5
07afa68247714e584456a1ff53b19b05

SHA1
e7d50cbba9ec8ab5238eb4f6723c642fa4c043c7

SHA256
d09c0376fabe37afd04ec67f2eff5adc62551f6edbe1473200edbd8ba8926710

SHA512
a74cec32e08e2bec826c53bb606b798570071f1664d2937bb37cf5e6d23c6c7200c4539ec1c541d32949d0c5aa0da522801fdbb2f9d4bd2f0d48068f730e30bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34312.exe

Filesize
468KB

MD5
a1c381bd2ff23bd48d128c5b7e721b1a

SHA1
8c05cbc8bbc1be6ee8a77ae8aa37035e22008d95

SHA256
007c9d8aec56a57c6182a2c689f890d6ce46b57e0648582abb2cbb220135b307

SHA512
56c37677040106151010cb343115ff043309c0a641939ceb2e177b22b4de562901572884c080718cb157c6e514b4ee794af426e4ac48c27081b70ee7f4dbece2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34537.exe

Filesize
468KB

MD5
cedc8da2cc5b9490810b5c73d093a645

SHA1
6e007a40a0d845bcd8116d95aa42f2dee862d8e5

SHA256
3400ee526f10dba50375b4eb2855542a620753826b7b5a6d7a01c4041717e0e3

SHA512
92266452a9005a274b3c901af64f8e567d0430f04f24ff3290a005964d7de3c26d0b0f4523e5069a11335e99981710bf6e805ae32e444fe6a940738056a6c43e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35982.exe

Filesize
468KB

MD5
f369e7a6b1107d5eb7dffd00475a4b74

SHA1
5521e4f80a042618461e4ebea4102316f8e1e542

SHA256
747f43ef94a5271a6da1851ed01a616707524b38619eec3f0ba7e1d6fbde38d0

SHA512
b1277a35bfdf8440e5e11d1d2baf5fc9bb73f3e9590acec1450cbd6f8e8de080bbe7310382704852326ea34481b00e1a56378dbb25ed3707a50f431eeca04b7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38836.exe

Filesize
468KB

MD5
ce5467ad4dbcc8ef488d71847c9a23d2

SHA1
83d8e4feb94e51799089f90455b84b69b05cc198

SHA256
759a16f69872d95bdd6e71782fc4480a46447e8b37930169e9b9c7e2d9233880

SHA512
6eac670b25edab4b09e750083fa4f37e3d8f46853d3fb64471e39e1ffa6409162b51472ead85e0edd6ad4abad32254374190c20e37045877e2080b0372dc76e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41636.exe

Filesize
468KB

MD5
4cfca61efe3089b1a7cf639f75d75960

SHA1
1c5f9f95d24e0f21c6075535fbf5c672cf2e39ca

SHA256
534a38a1eb20c949ea4fb2af1b065a9931cdb76ae1d6af54243bc2d94acdcaf6

SHA512
a33a79b11b9240a493fb54f2ffeb7717bad7eb17963316ef5e9d21d2fcc91ab1bd3b966d3847207839f1164c2cb0d7386b159b1b65ce73098df21247b398b0d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43359.exe

Filesize
468KB

MD5
bb32238d4ed7f9ec43b39d874901c454

SHA1
9de69df3bf5d331438e4a1b060bc96eff2986fb2

SHA256
9873f9e3992f7b6423d520287845375cf90c03d1683bad4199fa210a1089a46f

SHA512
48f63041fe6a307e69c023ad941af8483e7197569f8eecc75e4b27e3d4f82fb99569d12ec4ffefdd944120a62e18b52f2afc8af497fe4377eb5c94aa02607986

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47465.exe

Filesize
468KB

MD5
e0bc9209c4758ed4832826c54e537e25

SHA1
7e3628269012cbbf6b1d46fb1f3bde381708d5cb

SHA256
318357d41b8746fd874d7faf6f9ddbf3836ebb035a4808e3c1749d8aa0b1a2a9

SHA512
04ed3de3ee1735ffd069bfab9f6bf7eb18a4b35ab566ad5616952acc33bf30df74c478e68c598128e7dea72225a040480db802ab758a7d88e6273e4e9b9568fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47766.exe

Filesize
468KB

MD5
03ee67d0e6819359b3907ea90e78b874

SHA1
4e3fcb7efa9d41ae20a624916db638cfca3c7950

SHA256
6256bc010dfd92688408e424ad3c216aef928eba887a85350d398197beccb1e6

SHA512
aab22b18d3b8b286e76d0335f500b6dba63928c9cb40ff1db2551458ec341fac030240b882cf40ade823eee3d1cfd3f10b86d821d93c7a077a27b4420cf289f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47885.exe

Filesize
468KB

MD5
20418093a57300882ff2fb08084bcd71

SHA1
cadaf419a6d2a082295a6aa99906387add0c9f3d

SHA256
458bcd06fc178a475dbc92d15dd3077b2ccb6e8364743b2c06a1675043d83619

SHA512
6135a2eb0bd265a5414d12479614e305ab4a39f2c9d1b23950bec97988ab3c9eb29de7992efa600e8675ae106e3c38c57a4a525e12bbdb26b952525ad67c8306

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49718.exe

Filesize
468KB

MD5
cf38034423bf3c2b8b1ebed61ac3baf6

SHA1
cd7a7fc9a53362f8ab4b2ecdc895d134136d41bf

SHA256
b72fc2c02f9eb8fe692bd864f1c7596572b8f4b989396cdad6feb54781e54393

SHA512
47cb3a2c9691d96bab66d7cae9bad78d8da0bcd60b890d325cff5d1524caa6673faf6000b45cfcddcc9a823012d18c0870d7d3b7a5ca4a2ef76f640c745cb50d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50440.exe

Filesize
468KB

MD5
232c62c523bda8f442c5f4c1b0521e6b

SHA1
8b4e919a1afa94c8be9e538a2e51a3acdfd98051

SHA256
3664ef4e906d882ddf92bb8a3c2df96feff4f2fb8b6d29bfddf079530dd3c66f

SHA512
6aa62fb94825bbd50f4994da507908eb18b75ba64fd2923d57dd8d6e115199aca833a9ee2eb34507e04629e257f68127a6d18f4a7f2eebe74613da7a53ceb41e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52283.exe

Filesize
468KB

MD5
eb30225312d66e7abda862e9c244017d

SHA1
814e5f57bec3b5079c451d4d0ae81a94b46ac924

SHA256
1044a33b3657866d32b140ab18bd7828c2b13fa71a03ccccb95efca8305914fc

SHA512
db33f591c35afe94fbf3c083927ed68a62e0109936db8f13b0fc41d3658d1ffdd6a17b37b0e2036af4d18360c0616c43b173c09a2349e7fd5ed22cafec5f1894

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53896.exe

Filesize
468KB

MD5
c3522f1680e6b0eb4b4292a87381698e

SHA1
d4643d0636d4377cfd73d53ad050f65aa1c9bd33

SHA256
3ef104f1af3d1a1475c244161cbb52a809d3d180f9ab892a1d5d6f781d0f6404

SHA512
daf28d5f1d60b54be9a1c50a8932fad02c9c42a677ed96cb0dc06367037411a546f7f44735625d71b5512192f3b25b25a4ed68c9b6c841e6ca4feefe49ef6a20

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58031.exe

Filesize
468KB

MD5
f37116c33461079f12a81c2dffe3fe46

SHA1
3a5d9b9103f5ad96496c31de7b199909d559c353

SHA256
f081bdb7078e9f0f34a5144462a5dda72b4af39b4f2ee21f390c8a0ac556bfe1

SHA512
9fb178344bb29c035f7d3fca8377a5911f4518f6fe33c7a024ce3f7ac33d88b742edae1ca60995e548e2dc1517f976b5c3288db30d9afbe835bde2f468fed685

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61145.exe

Filesize
468KB

MD5
8966d98757729e33932b747690435737

SHA1
84717a65397e05a44f2ce9349c87285576fdea4a

SHA256
7486fb71bc6b708a4b0ca26c3003ad3e48700151a66fd9d98c9d970bf9f80979

SHA512
482c039c1238272f43953cc159fdfc913f6cb147ca8ddd8a33dbe37e9f44b6203e375b3d0767cc17348a96215088b56b1512d3c4625165fa2ce7b5fc344a50ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62770.exe

Filesize
468KB

MD5
1605d6029b990266fbe50bf75a34e67b

SHA1
bb1391ff1fa9bb311fdcb35f4cc51a0b7149a20e

SHA256
8a15eabcd2e6dc9ff7d372a7be6dad92aee642c3da9a3bc025dd12eaedf8c061

SHA512
bdd258e0294fdb6a100b9937ffde078116fe4f41844b1e8b117395be24ef5a3fdbe15ebbdb7e6c8b99fcf1e286152cf57cef3dcb77d1ecca0df034f66ebdd690

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62841.exe

Filesize
468KB

MD5
e0594729d3be3230eeb39e7221c96d57

SHA1
280b86d245626ab1578e4db24d65576b360a7fc4

SHA256
cc40af8fb1eacdd202ed9a6b7aa563b306c974b95e50d429a113cba6ff91405b

SHA512
38c15c98500ee56423c2eb134966ee194624f855b3c61d62390af73eb140b5c680b9104c57119e7be2771623951433b70fbe6f28fc5058dea88f6a36c5f8bf03

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-65282.exe

Filesize
468KB

MD5
f99b0bc1545aedbd30cf276e56458ae2

SHA1
cf45308e9755b016b18240b547a670ab9c2a86e0

SHA256
0ad2cd4ea6055454f98981479d8c5d4e395563bdeb54f80b699d4c4a843c430b

SHA512
3d0e0f0a6467b9535c55b88efea6c891da7283f855edf2f389e858b2628d7e3db351fa2fe44bfbcbccc8477f10f7d3118219ecc536aca984da8ff1c562cf5201

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads