bd219c79082f8c316569ace1895c5824e341d59a8f0e364486727f95b7f42d6a

Analysis

max time kernel
120s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/09/2024, 15:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e15e86095b81748de9d225737154bf20N.exe
Size

468KB
MD5

e15e86095b81748de9d225737154bf20
SHA1

3f8b5aa923aaa9a9fd82f398287a2218e5b2caec
SHA256

bd219c79082f8c316569ace1895c5824e341d59a8f0e364486727f95b7f42d6a
SHA512

2ce2b77b637e3fa30efae66f6180dca3edd6cdd048a27d5a9bcc57ceeb827f1101c78f5846979d9226e27cb8c25c61dd1d5548719ddc08d15c67443cd0f3700f
SSDEEP

3072:4MetoFI/IU579bYEPzmjbfD/VCLHsIp9QmHeQVY6K2cLWPKuUhlF:4M0o1c797PqjbfF0kkK2WEKuU

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4108	Unicorn-50986.exe
2932	Unicorn-7753.exe
4280	Unicorn-58386.exe
4124	Unicorn-39907.exe
3332	Unicorn-60005.exe
3520	Unicorn-19487.exe
212	Unicorn-40876.exe
3292	Unicorn-63555.exe
3932	Unicorn-23269.exe
388	Unicorn-39243.exe
1712	Unicorn-33112.exe
2488	Unicorn-31075.exe
1352	Unicorn-18823.exe
1308	Unicorn-10389.exe
4864	Unicorn-56326.exe
3160	Unicorn-33379.exe
1860	Unicorn-53477.exe
3012	Unicorn-61391.exe
1912	Unicorn-38925.exe
3880	Unicorn-8298.exe
1436	Unicorn-45247.exe
2344	Unicorn-45247.exe
1812	Unicorn-36010.exe
4008	Unicorn-27824.exe
1696	Unicorn-25024.exe
3372	Unicorn-1837.exe
4444	Unicorn-29606.exe
2100	Unicorn-1837.exe
3304	Unicorn-1837.exe
1404	Unicorn-43275.exe
4920	Unicorn-15241.exe
4744	Unicorn-35107.exe
5096	Unicorn-3403.exe
2644	Unicorn-9725.exe
5024	Unicorn-51313.exe
5060	Unicorn-63887.exe
4596	Unicorn-47286.exe
2560	Unicorn-12273.exe
1572	Unicorn-63934.exe
2092	Unicorn-44069.exe
4960	Unicorn-15418.exe
3316	Unicorn-31755.exe
4980	Unicorn-59466.exe
3748	Unicorn-39600.exe
3684	Unicorn-12081.exe
216	Unicorn-25816.exe
4172	Unicorn-7442.exe
2252	Unicorn-18733.exe
2044	Unicorn-20655.exe
3320	Unicorn-12486.exe
4248	Unicorn-47197.exe
3904	Unicorn-60618.exe
2752	Unicorn-59449.exe
2232	Unicorn-42.exe
4440	Unicorn-57411.exe
4788	Unicorn-11972.exe
3116	Unicorn-36726.exe
3740	Unicorn-28060.exe
1608	Unicorn-28312.exe
3456	Unicorn-58947.exe
4000	Unicorn-38527.exe
688	Unicorn-42611.exe
1924	Unicorn-1770.exe
3648	Unicorn-39273.exe

Program crash 7 IoCs

pid	pid_target	Process	procid_target
7028	2896	WerFault.exe	169
9024	6212	WerFault.exe	247
11216	7596	WerFault.exe	321
14184	6516	WerFault.exe	400
14868	6516	WerFault.exe	400
16576	10156	WerFault.exe	463
16452	15400	WerFault.exe	765

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27861.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31075.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43056.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45299.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58698.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19481.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62214.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39591.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51402.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45813.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26661.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-407.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17119.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18019.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17997.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21226.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39487.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30655.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58506.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7933.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38812.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20197.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24947.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63693.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44111.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29231.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48508.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7112.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29835.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23499.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62149.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48360.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26744.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62066.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49534.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16356.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33379.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59466.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1246.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2538.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56363.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61528.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57685.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14704.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47167.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63934.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39591.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7933.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42087.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32492.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62869.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26815.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23428.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38680.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51165.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27963.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39600.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	18120	dwm.exe
Token: SeChangeNotifyPrivilege	18120	dwm.exe
Token: 33	18120	dwm.exe
Token: SeIncBasePriorityPrivilege	18120	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
464	e15e86095b81748de9d225737154bf20N.exe
4108	Unicorn-50986.exe
2932	Unicorn-7753.exe
4280	Unicorn-58386.exe
4124	Unicorn-39907.exe
3332	Unicorn-60005.exe
3520	Unicorn-19487.exe
212	Unicorn-40876.exe
3292	Unicorn-63555.exe
3932	Unicorn-23269.exe
1712	Unicorn-33112.exe
388	Unicorn-39243.exe
2488	Unicorn-31075.exe
1308	Unicorn-10389.exe
1352	Unicorn-18823.exe
4864	Unicorn-56326.exe
3160	Unicorn-33379.exe
1860	Unicorn-53477.exe
3012	Unicorn-61391.exe
1912	Unicorn-38925.exe
3880	Unicorn-8298.exe
1436	Unicorn-45247.exe
2344	Unicorn-45247.exe
1812	Unicorn-36010.exe
2100	Unicorn-1837.exe
3372	Unicorn-1837.exe
4444	Unicorn-29606.exe
3304	Unicorn-1837.exe
1696	Unicorn-25024.exe
4008	Unicorn-27824.exe
1404	Unicorn-43275.exe
4920	Unicorn-15241.exe
4744	Unicorn-35107.exe
5096	Unicorn-3403.exe
2644	Unicorn-9725.exe
5024	Unicorn-51313.exe
5060	Unicorn-63887.exe
2560	Unicorn-12273.exe
4596	Unicorn-47286.exe
2092	Unicorn-44069.exe
1572	Unicorn-63934.exe
4960	Unicorn-15418.exe
3316	Unicorn-31755.exe
4980	Unicorn-59466.exe
3748	Unicorn-39600.exe
3684	Unicorn-12081.exe
216	Unicorn-25816.exe
4172	Unicorn-7442.exe
2252	Unicorn-18733.exe
2044	Unicorn-20655.exe
2232	Unicorn-42.exe
3904	Unicorn-60618.exe
2752	Unicorn-59449.exe
3116	Unicorn-36726.exe
4440	Unicorn-57411.exe
4788	Unicorn-11972.exe
4248	Unicorn-47197.exe
3320	Unicorn-12486.exe
3740	Unicorn-28060.exe
1608	Unicorn-28312.exe
3456	Unicorn-58947.exe
4000	Unicorn-38527.exe
688	Unicorn-42611.exe
1924	Unicorn-1770.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 464 wrote to memory of 4108	464	e15e86095b81748de9d225737154bf20N.exe	89
PID 464 wrote to memory of 4108	464	e15e86095b81748de9d225737154bf20N.exe	89
PID 464 wrote to memory of 4108	464	e15e86095b81748de9d225737154bf20N.exe	89
PID 4108 wrote to memory of 2932	4108	Unicorn-50986.exe	92
PID 4108 wrote to memory of 2932	4108	Unicorn-50986.exe	92
PID 4108 wrote to memory of 2932	4108	Unicorn-50986.exe	92
PID 464 wrote to memory of 4280	464	e15e86095b81748de9d225737154bf20N.exe	93
PID 464 wrote to memory of 4280	464	e15e86095b81748de9d225737154bf20N.exe	93
PID 464 wrote to memory of 4280	464	e15e86095b81748de9d225737154bf20N.exe	93
PID 2932 wrote to memory of 4124	2932	Unicorn-7753.exe	95
PID 2932 wrote to memory of 4124	2932	Unicorn-7753.exe	95
PID 2932 wrote to memory of 4124	2932	Unicorn-7753.exe	95
PID 4108 wrote to memory of 3332	4108	Unicorn-50986.exe	96
PID 4108 wrote to memory of 3332	4108	Unicorn-50986.exe	96
PID 4108 wrote to memory of 3332	4108	Unicorn-50986.exe	96
PID 4280 wrote to memory of 3520	4280	Unicorn-58386.exe	97
PID 4280 wrote to memory of 3520	4280	Unicorn-58386.exe	97
PID 4280 wrote to memory of 3520	4280	Unicorn-58386.exe	97
PID 464 wrote to memory of 212	464	e15e86095b81748de9d225737154bf20N.exe	98
PID 464 wrote to memory of 212	464	e15e86095b81748de9d225737154bf20N.exe	98
PID 464 wrote to memory of 212	464	e15e86095b81748de9d225737154bf20N.exe	98
PID 4124 wrote to memory of 3292	4124	Unicorn-39907.exe	101
PID 4124 wrote to memory of 3292	4124	Unicorn-39907.exe	101
PID 4124 wrote to memory of 3292	4124	Unicorn-39907.exe	101
PID 2932 wrote to memory of 3932	2932	Unicorn-7753.exe	102
PID 2932 wrote to memory of 3932	2932	Unicorn-7753.exe	102
PID 2932 wrote to memory of 3932	2932	Unicorn-7753.exe	102
PID 3332 wrote to memory of 388	3332	Unicorn-60005.exe	104
PID 3332 wrote to memory of 388	3332	Unicorn-60005.exe	104
PID 3332 wrote to memory of 388	3332	Unicorn-60005.exe	104
PID 4108 wrote to memory of 1712	4108	Unicorn-50986.exe	103
PID 4108 wrote to memory of 1712	4108	Unicorn-50986.exe	103
PID 4108 wrote to memory of 1712	4108	Unicorn-50986.exe	103
PID 3520 wrote to memory of 2488	3520	Unicorn-19487.exe	105
PID 3520 wrote to memory of 2488	3520	Unicorn-19487.exe	105
PID 3520 wrote to memory of 2488	3520	Unicorn-19487.exe	105
PID 464 wrote to memory of 1308	464	e15e86095b81748de9d225737154bf20N.exe	107
PID 464 wrote to memory of 1308	464	e15e86095b81748de9d225737154bf20N.exe	107
PID 464 wrote to memory of 1308	464	e15e86095b81748de9d225737154bf20N.exe	107
PID 212 wrote to memory of 1352	212	Unicorn-40876.exe	106
PID 212 wrote to memory of 1352	212	Unicorn-40876.exe	106
PID 212 wrote to memory of 1352	212	Unicorn-40876.exe	106
PID 4280 wrote to memory of 4864	4280	Unicorn-58386.exe	108
PID 4280 wrote to memory of 4864	4280	Unicorn-58386.exe	108
PID 4280 wrote to memory of 4864	4280	Unicorn-58386.exe	108
PID 3292 wrote to memory of 3160	3292	Unicorn-63555.exe	109
PID 3292 wrote to memory of 3160	3292	Unicorn-63555.exe	109
PID 3292 wrote to memory of 3160	3292	Unicorn-63555.exe	109
PID 4124 wrote to memory of 1860	4124	Unicorn-39907.exe	110
PID 4124 wrote to memory of 1860	4124	Unicorn-39907.exe	110
PID 4124 wrote to memory of 1860	4124	Unicorn-39907.exe	110
PID 3932 wrote to memory of 3012	3932	Unicorn-23269.exe	111
PID 3932 wrote to memory of 3012	3932	Unicorn-23269.exe	111
PID 3932 wrote to memory of 3012	3932	Unicorn-23269.exe	111
PID 2932 wrote to memory of 1912	2932	Unicorn-7753.exe	112
PID 2932 wrote to memory of 1912	2932	Unicorn-7753.exe	112
PID 2932 wrote to memory of 1912	2932	Unicorn-7753.exe	112
PID 1712 wrote to memory of 3880	1712	Unicorn-33112.exe	113
PID 1712 wrote to memory of 3880	1712	Unicorn-33112.exe	113
PID 1712 wrote to memory of 3880	1712	Unicorn-33112.exe	113
PID 4864 wrote to memory of 2344	4864	Unicorn-56326.exe	115
PID 1308 wrote to memory of 1436	1308	Unicorn-10389.exe	114
PID 4864 wrote to memory of 2344	4864	Unicorn-56326.exe	115
PID 1308 wrote to memory of 1436	1308	Unicorn-10389.exe	114

C:\Users\Admin\AppData\Local\Temp\e15e86095b81748de9d225737154bf20N.exe
"C:\Users\Admin\AppData\Local\Temp\e15e86095b81748de9d225737154bf20N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:464
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50986.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50986.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7753.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7753.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39907.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39907.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63555.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33379.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43275.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58947.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61443.exe
        9⤵
        
        PID:3244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30027.exe
        10⤵
        
        PID:7500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57515.exe
        11⤵
        
        PID:7952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23044.exe
        11⤵
        
        PID:15008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64144.exe
        11⤵
        
        PID:17864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27665.exe
        10⤵
        
        PID:1588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-177.exe
        9⤵
        
        PID:4840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17036.exe
        9⤵
        
        PID:9860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52636.exe
        9⤵
        
        PID:16108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50322.exe
        8⤵
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20515.exe
        9⤵
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49534.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:11400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58669.exe
        10⤵
        
        PID:16136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3737.exe
        9⤵
        
        PID:10520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40117.exe
        9⤵
        
        PID:16400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4788.exe
        9⤵
        
        PID:16548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58848.exe
        9⤵
        
        PID:16460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16688.exe
        8⤵
        
        PID:7244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16020.exe
        8⤵
        
        PID:11748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62066.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:17928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39273.exe
        7⤵
        Executes dropped EXE
        
        PID:3648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25455.exe
        8⤵
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26410.exe
        9⤵
        
        PID:7180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40606.exe
        10⤵
        
        PID:13672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63760.exe
        10⤵
        
        PID:18344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38521.exe
        9⤵
        
        PID:11688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38913.exe
        9⤵
        
        PID:17304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27861.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:16960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1137.exe
        8⤵
        
        PID:7604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21564.exe
        8⤵
        
        PID:12920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35562.exe
        8⤵
        
        PID:17348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38812.exe
        8⤵
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47384.exe
        7⤵
        
        PID:6284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39429.exe
        8⤵
        
        PID:9120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11040.exe
        8⤵
        
        PID:13640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31795.exe
        8⤵
        
        PID:17760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12569.exe
        7⤵
        
        PID:9196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58728.exe
        7⤵
        
        PID:13008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43225.exe
        7⤵
        
        PID:17212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27090.exe
        7⤵
        
        PID:16688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15241.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41385.exe
        7⤵
        
        PID:4688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39591.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17770.exe
        9⤵
        
        PID:9296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17040.exe
        9⤵
        
        PID:13172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62346.exe
        8⤵
        
        PID:9528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57575.exe
        9⤵
        
        PID:15436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50485.exe
        8⤵
        
        PID:14624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60960.exe
        8⤵
        
        PID:18424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15536.exe
        7⤵
        
        PID:7288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51402.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26661.exe
        8⤵
        
        PID:13880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47477.exe
        8⤵
        
        PID:2824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19424.exe
        7⤵
        
        PID:10232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14622.exe
        8⤵
        
        PID:15056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44545.exe
        8⤵
        
        PID:17796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47301.exe
        7⤵
        
        PID:15420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24580.exe
        7⤵
        
        PID:17772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52433.exe
        6⤵
        
        PID:1452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16903.exe
        7⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50447.exe
        8⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7596 -s 488
        9⤵
        Program crash
        
        PID:11216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62214.exe
        8⤵
        
        PID:13364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31748.exe
        8⤵
        
        PID:16636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37125.exe
        7⤵
        
        PID:7320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17036.exe
        7⤵
        
        PID:11252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8628.exe
        7⤵
        
        PID:5812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6653.exe
        6⤵
        
        PID:7008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55403.exe
        7⤵
        
        PID:9720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26661.exe
        7⤵
        
        PID:12740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53184.exe
        7⤵
        
        PID:16712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7744.exe
        6⤵
        
        PID:10152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17444.exe
        6⤵
        
        PID:15100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53477.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35107.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42611.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11858.exe
        8⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50831.exe
        9⤵
        
        PID:4500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16862.exe
        10⤵
        
        PID:11988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22571.exe
        10⤵
        
        PID:16844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62149.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:11276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31320.exe
        9⤵
        
        PID:17152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23393.exe
        9⤵
        
        PID:16440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65044.exe
        9⤵
        
        PID:18208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33233.exe
        8⤵
        
        PID:8772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57685.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9455.exe
        8⤵
        
        PID:3440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17997.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15658.exe
        8⤵
        
        PID:8580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29412.exe
        9⤵
        
        PID:6716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40441.exe
        8⤵
        
        PID:11596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57937.exe
        8⤵
        
        PID:14196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61073.exe
        8⤵
        
        PID:15572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61717.exe
        7⤵
        
        PID:9776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43138.exe
        7⤵
        
        PID:13680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14193.exe
        6⤵
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25263.exe
        7⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29835.exe
        8⤵
        
        PID:7528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4910.exe
        9⤵
        
        PID:11568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9993.exe
        9⤵
        
        PID:17340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28900.exe
        8⤵
        
        PID:10752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35817.exe
        7⤵
        
        PID:7436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29231.exe
        8⤵
        
        PID:13436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33065.exe
        8⤵
        
        PID:16584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44748.exe
        7⤵
        
        PID:12200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18775.exe
        7⤵
        
        PID:16540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11504.exe
        6⤵
        
        PID:6192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32103.exe
        7⤵
        
        PID:8172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56830.exe
        8⤵
        
        PID:10632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26980.exe
        7⤵
        
        PID:8996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7252.exe
        7⤵
        
        PID:15476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36885.exe
        7⤵
        
        PID:16392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32900.exe
        7⤵
        
        PID:16832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32364.exe
        7⤵
        
        PID:18248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59493.exe
        6⤵
        
        PID:10156
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10156 -s 652
        7⤵
        Program crash
        
        PID:16576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24670.exe
        6⤵
        
        PID:16380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3403.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38527.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24111.exe
        7⤵
        
        PID:5144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1246.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44111.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:9900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26661.exe
        9⤵
        
        PID:13996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30981.exe
        8⤵
        
        PID:10848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31216.exe
        8⤵
        
        PID:15076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53270.exe
        7⤵
        
        PID:8152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8426.exe
        8⤵
        
        PID:13164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63429.exe
        8⤵
        
        PID:18508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62214.exe
        7⤵
        
        PID:13384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45905.exe
        6⤵
        
        PID:6732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41999.exe
        7⤵
        
        PID:9124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23868.exe
        7⤵
        
        PID:14148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12335.exe
        7⤵
        
        PID:18104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3197.exe
        6⤵
        
        PID:10008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37596.exe
        6⤵
        
        PID:13468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33794.exe
        5⤵
        
        PID:2124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25455.exe
        6⤵
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43239.exe
        7⤵
        
        PID:7384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-530.exe
        8⤵
        
        PID:10392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36365.exe
        8⤵
        
        PID:15388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40461.exe
        8⤵
        
        PID:17640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36217.exe
        7⤵
        
        PID:10344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40117.exe
        7⤵
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30362.exe
        7⤵
        
        PID:16520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46596.exe
        7⤵
        
        PID:16068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13389.exe
        6⤵
        
        PID:8372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54237.exe
        6⤵
        
        PID:12992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4041.exe
        6⤵
        
        PID:16492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48900.exe
        6⤵
        
        PID:18224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3888.exe
        5⤵
        
        PID:6036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45891.exe
        6⤵
        
        PID:8964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33310.exe
        7⤵
        
        PID:16432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8260.exe
        7⤵
        
        PID:16620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40057.exe
        6⤵
        
        PID:12388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27633.exe
        6⤵
        
        PID:5252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22729.exe
        5⤵
        
        PID:9892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31535.exe
        6⤵
        
        PID:14296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27148.exe
        6⤵
        
        PID:16824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42211.exe
        5⤵
        
        PID:14192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24344.exe
        5⤵
        
        PID:17264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23269.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23269.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61391.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9725.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29482.exe
        7⤵
        
        PID:1084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25455.exe
        8⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9414.exe
        9⤵
        
        PID:7580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42243.exe
        10⤵
        
        PID:11468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17585.exe
        10⤵
        
        PID:17180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34629.exe
        9⤵
        
        PID:11328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17119.exe
        10⤵
        
        PID:16220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27876.exe
        10⤵
        
        PID:16640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35872.exe
        9⤵
        
        PID:5868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10244.exe
        8⤵
        
        PID:7852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7933.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:13752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63760.exe
        9⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56917.exe
        8⤵
        
        PID:11932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22276.exe
        8⤵
        
        PID:16108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4676.exe
        7⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18782.exe
        8⤵
        
        PID:8188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13086.exe
        9⤵
        
        PID:13792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3408.exe
        9⤵
        
        PID:16664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58641.exe
        8⤵
        
        PID:12228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-725.exe
        8⤵
        
        PID:16208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36445.exe
        7⤵
        
        PID:8880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60294.exe
        7⤵
        
        PID:13024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36.exe
        7⤵
        
        PID:17372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52294.exe
        6⤵
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21034.exe
        7⤵
        
        PID:5552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15658.exe
        8⤵
        
        PID:8572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64207.exe
        9⤵
        
        PID:14580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63760.exe
        9⤵
        
        PID:5136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40441.exe
        8⤵
        
        PID:11564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53853.exe
        8⤵
        
        PID:16728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60497.exe
        8⤵
        
        PID:16700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37379.exe
        7⤵
        
        PID:10332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51882.exe
        7⤵
        
        PID:15304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22276.exe
        7⤵
        
        PID:16376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10108.exe
        6⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44687.exe
        7⤵
        
        PID:10148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36557.exe
        7⤵
        
        PID:15128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45813.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33616.exe
        6⤵
        
        PID:14872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33173.exe
        6⤵
        
        PID:16464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9118.exe
        6⤵
        
        PID:17088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51313.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1770.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44531.exe
        7⤵
        
        PID:5304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22186.exe
        8⤵
        
        PID:6376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23115.exe
        9⤵
        
        PID:9344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63434.exe
        10⤵
        
        PID:16892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37424.exe
        10⤵
        
        PID:13692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55784.exe
        10⤵
        
        PID:18384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22385.exe
        9⤵
        
        PID:14120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28591.exe
        9⤵
        
        PID:4656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62346.exe
        8⤵
        
        PID:9024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46017.exe
        8⤵
        
        PID:6988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38812.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:17264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30197.exe
        7⤵
        
        PID:7704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32547.exe
        8⤵
        
        PID:13292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38488.exe
        8⤵
        
        PID:1364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48365.exe
        7⤵
        
        PID:11340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37186.exe
        7⤵
        
        PID:17140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10752.exe
        7⤵
        
        PID:16916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8628.exe
        7⤵
        
        PID:5908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6020.exe
        6⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2289.exe
        7⤵
        
        PID:8608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30243.exe
        8⤵
        
        PID:16624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11924.exe
        8⤵
        
        PID:3276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11040.exe
        7⤵
        
        PID:13652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8893.exe
        7⤵
        
        PID:16792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19927.exe
        7⤵
        
        PID:18216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35293.exe
        6⤵
        
        PID:6516
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6516 -s 632
        7⤵
        Program crash
        
        PID:14184
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6516 -s 632
        7⤵
        Program crash
        
        PID:14868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53741.exe
        6⤵
        
        PID:14244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52433.exe
        5⤵
        
        PID:1468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45299.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15658.exe
        7⤵
        
        PID:8592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59793.exe
        7⤵
        
        PID:11764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57553.exe
        7⤵
        
        PID:16948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61073.exe
        7⤵
        
        PID:5916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37379.exe
        6⤵
        
        PID:10308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13772.exe
        6⤵
        
        PID:15876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13521.exe
        6⤵
        
        PID:16388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30966.exe
        5⤵
        
        PID:6952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39429.exe
        6⤵
        
        PID:8348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10848.exe
        6⤵
        
        PID:13376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60960.exe
        6⤵
        
        PID:7840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32492.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37155.exe
        6⤵
        
        PID:14540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60174.exe
        5⤵
        
        PID:12640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23239.exe
        5⤵
        
        PID:5968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38925.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38925.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63887.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34059.exe
        6⤵
        
        PID:4412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13202.exe
        7⤵
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31179.exe
        8⤵
        
        PID:7564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55626.exe
        8⤵
        
        PID:12084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52893.exe
        8⤵
        
        PID:16620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50253.exe
        8⤵
        
        PID:2416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43321.exe
        7⤵
        
        PID:8732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57575.exe
        8⤵
        
        PID:15396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16356.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4676.exe
        6⤵
        
        PID:4912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39429.exe
        7⤵
        
        PID:9020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38442.exe
        8⤵
        
        PID:15000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64441.exe
        8⤵
        
        PID:16624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2296.exe
        7⤵
        
        PID:13196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35562.exe
        7⤵
        
        PID:17360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60960.exe
        7⤵
        
        PID:18308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6704.exe
        6⤵
        
        PID:7916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53741.exe
        6⤵
        
        PID:14252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53745.exe
        6⤵
        
        PID:18576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52294.exe
        5⤵
        
        PID:3608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57406.exe
        6⤵
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39429.exe
        7⤵
        
        PID:8160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30775.exe
        7⤵
        
        PID:12240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49158.exe
        7⤵
        
        PID:15924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60960.exe
        7⤵
        
        PID:5128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58506.exe
        6⤵
        
        PID:9188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9888.exe
        6⤵
        
        PID:12668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63418.exe
        6⤵
        
        PID:17104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39772.exe
        6⤵
        
        PID:5824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19947.exe
        5⤵
        
        PID:6924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1158.exe
        6⤵
        
        PID:9064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49459.exe
        7⤵
        
        PID:13240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8939.exe
        7⤵
        
        PID:5256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8405.exe
        6⤵
        
        PID:12604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43846.exe
        5⤵
        
        PID:9864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37596.exe
        5⤵
        
        PID:13324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47286.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47286.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29482.exe
        5⤵
        
        PID:5072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37707.exe
        6⤵
        
        PID:5580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29835.exe
        7⤵
        
        PID:7376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55403.exe
        8⤵
        
        PID:9688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30745.exe
        8⤵
        
        PID:14216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12831.exe
        8⤵
        
        PID:2560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65361.exe
        7⤵
        
        PID:9364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50101.exe
        7⤵
        
        PID:15372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44424.exe
        7⤵
        
        PID:18328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10244.exe
        6⤵
        
        PID:7816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46143.exe
        7⤵
        
        PID:12380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41410.exe
        6⤵
        
        PID:13588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52785.exe
        6⤵
        
        PID:18336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63306.exe
        5⤵
        
        PID:6212
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6212 -s 636
        6⤵
        Program crash
        
        PID:9024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61717.exe
        5⤵
        
        PID:9600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1145.exe
        5⤵
        
        PID:3600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14028.exe
      4⤵
      PID:4808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1682.exe
        5⤵
        
        PID:5368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15658.exe
        6⤵
        
        PID:8620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35781.exe
        6⤵
        
        PID:3844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2360.exe
        6⤵
        
        PID:16820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37379.exe
        5⤵
        
        PID:10324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64046.exe
        6⤵
        
        PID:16536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43869.exe
        6⤵
        
        PID:16864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13772.exe
        5⤵
        
        PID:15896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34820.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34820.exe
      4⤵
      PID:6280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27748.exe
        5⤵
        
        PID:10764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-420.exe
        5⤵
        
        PID:17236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34554.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34554.exe
      4⤵
      PID:11064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48988.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48988.exe
      4⤵
      PID:13280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60005.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60005.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39243.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39243.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36010.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59466.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27043.exe
        7⤵
        
        PID:3140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3472.exe
        8⤵
        
        PID:6492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55403.exe
        9⤵
        
        PID:9672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47082.exe
        9⤵
        
        PID:12116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32047.exe
        9⤵
        
        PID:17532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10544.exe
        8⤵
        
        PID:9540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6272.exe
        8⤵
        
        PID:15308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61910.exe
        7⤵
        
        PID:6184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49290.exe
        8⤵
        
        PID:9080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46143.exe
        9⤵
        
        PID:12420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38680.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:17748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57414.exe
        8⤵
        
        PID:12472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38173.exe
        7⤵
        
        PID:10116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2297.exe
        7⤵
        
        PID:14588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53508.exe
        7⤵
        
        PID:16692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57146.exe
        6⤵
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39975.exe
        7⤵
        
        PID:6816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52990.exe
        8⤵
        
        PID:8556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35619.exe
        9⤵
        
        PID:14432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33293.exe
        8⤵
        
        PID:12464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35428.exe
        7⤵
        
        PID:3272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24828.exe
        7⤵
        
        PID:15080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4472.exe
        7⤵
        
        PID:17908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3284.exe
        6⤵
        
        PID:7300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33395.exe
        7⤵
        
        PID:1788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36557.exe
        7⤵
        
        PID:15152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14704.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42189.exe
        7⤵
        
        PID:18464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45621.exe
        6⤵
        
        PID:10812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28416.exe
        6⤵
        
        PID:15748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12081.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30058.exe
        6⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21034.exe
        7⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9414.exe
        8⤵
        
        PID:7540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64723.exe
        9⤵
        
        PID:9804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11285.exe
        9⤵
        
        PID:13732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62346.exe
        8⤵
        
        PID:2432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36780.exe
        8⤵
        
        PID:15052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39772.exe
        8⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10244.exe
        7⤵
        
        PID:7700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17036.exe
        7⤵
        
        PID:11292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27404.exe
        6⤵
        
        PID:7656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51402.exe
        7⤵
        
        PID:9816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26568.exe
        8⤵
        
        PID:2064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26661.exe
        7⤵
        
        PID:13432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21995.exe
        7⤵
        
        PID:17392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16409.exe
        6⤵
        
        PID:10184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4482.exe
        7⤵
        
        PID:15928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63144.exe
        6⤵
        
        PID:15296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18384.exe
        6⤵
        
        PID:13692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53393.exe
        5⤵
        
        PID:5496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25153.exe
        6⤵
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58195.exe
        7⤵
        
        PID:11548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44721.exe
        7⤵
        
        PID:17264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17472.exe
        6⤵
        
        PID:11256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13117.exe
        6⤵
        
        PID:16280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49709.exe
        6⤵
        
        PID:16260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15973.exe
        5⤵
        
        PID:3492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44111.exe
        6⤵
        
        PID:9872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26661.exe
        6⤵
        
        PID:13548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60589.exe
        6⤵
        
        PID:16496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24080.exe
        5⤵
        
        PID:10224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63630.exe
        5⤵
        
        PID:14984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51391.exe
        5⤵
        
        PID:17180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13919.exe
        5⤵
        
        PID:5184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1837.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1837.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20655.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10322.exe
        6⤵
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30655.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32487.exe
        8⤵
        
        PID:8652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40441.exe
        8⤵
        
        PID:12456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55453.exe
        8⤵
        
        PID:11000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47982.exe
        7⤵
        
        PID:9624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44481.exe
        7⤵
        
        PID:14200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37031.exe
        7⤵
        
        PID:17952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40420.exe
        6⤵
        
        PID:6436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41999.exe
        7⤵
        
        PID:9132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20081.exe
        7⤵
        
        PID:12912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62869.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35707.exe
        6⤵
        
        PID:16152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15213.exe
        6⤵
        
        PID:16760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27405.exe
        5⤵
        
        PID:5520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29835.exe
        6⤵
        
        PID:7556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61711.exe
        7⤵
        
        PID:13216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54638.exe
        7⤵
        
        PID:16632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62214.exe
        6⤵
        
        PID:12488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15260.exe
        6⤵
        
        PID:17428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23979.exe
        5⤵
        
        PID:7844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6638.exe
        6⤵
        
        PID:12364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13221.exe
        6⤵
        
        PID:16768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9689.exe
        5⤵
        
        PID:11308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36972.exe
        5⤵
        
        PID:17092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59449.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59449.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14598.exe
        5⤵
        
        PID:5480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30655.exe
        6⤵
        
        PID:6688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27007.exe
        7⤵
        
        PID:9240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22385.exe
        7⤵
        
        PID:14136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59729.exe
        7⤵
        
        PID:6460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62346.exe
        6⤵
        
        PID:9368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-407.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10720.exe
        6⤵
        
        PID:16160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61910.exe
        5⤵
        
        PID:5704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55403.exe
        6⤵
        
        PID:9696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26661.exe
        6⤵
        
        PID:13536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10544.exe
        5⤵
        
        PID:10228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6272.exe
        5⤵
        
        PID:15316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60508.exe
        5⤵
        
        PID:14972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28809.exe
        5⤵
        
        PID:9140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63425.exe
      4⤵
      PID:5828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42087.exe
        5⤵
        
        PID:7444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21255.exe
        6⤵
        
        PID:13660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12821.exe
        5⤵
        
        PID:13724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44424.exe
        5⤵
        
        PID:5476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23172.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23172.exe
      4⤵
      PID:8076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34841.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34841.exe
      4⤵
      PID:12436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55667.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55667.exe
      4⤵
      PID:15448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9259.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9259.exe
      4⤵
      PID:15596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33112.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33112.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8298.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8298.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63934.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58563.exe
        6⤵
        
        PID:1820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57551.exe
        7⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62123.exe
        8⤵
        
        PID:7632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45450.exe
        9⤵
        
        PID:11440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17585.exe
        9⤵
        
        PID:17172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10620.exe
        9⤵
        
        PID:16504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-761.exe
        8⤵
        
        PID:12716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53078.exe
        7⤵
        
        PID:8204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29034.exe
        8⤵
        
        PID:16172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62214.exe
        7⤵
        
        PID:13248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5444.exe
        6⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18782.exe
        7⤵
        
        PID:8180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38058.exe
        8⤵
        
        PID:15200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63760.exe
        8⤵
        
        PID:18416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40441.exe
        7⤵
        
        PID:11392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39377.exe
        6⤵
        
        PID:7940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51763.exe
        7⤵
        
        PID:14656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11924.exe
        7⤵
        
        PID:2164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27430.exe
        6⤵
        
        PID:12984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36.exe
        6⤵
        
        PID:17108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43056.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21034.exe
        6⤵
        
        PID:5504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19851.exe
        7⤵
        
        PID:7932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46763.exe
        8⤵
        
        PID:10884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53361.exe
        8⤵
        
        PID:15412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27963.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:18480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56529.exe
        7⤵
        
        PID:10512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27371.exe
        7⤵
        
        PID:16628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59718.exe
        7⤵
        
        PID:16744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31027.exe
        7⤵
        
        PID:16648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33809.exe
        6⤵
        
        PID:8096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19859.exe
        7⤵
        
        PID:7596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27876.exe
        7⤵
        
        PID:5464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26224.exe
        6⤵
        
        PID:12624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50445.exe
        6⤵
        
        PID:3912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45713.exe
        5⤵
        
        PID:7056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64723.exe
        6⤵
        
        PID:9796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26661.exe
        6⤵
        
        PID:13568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51352.exe
        6⤵
        
        PID:16440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16409.exe
        5⤵
        
        PID:6668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47685.exe
        5⤵
        
        PID:6716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44069.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44069.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34059.exe
        5⤵
        
        PID:4340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36446.exe
        6⤵
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42087.exe
        7⤵
        
        PID:7512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58771.exe
        8⤵
        
        PID:11380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17585.exe
        8⤵
        
        PID:17164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17527.exe
        8⤵
        
        PID:16896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54177.exe
        7⤵
        
        PID:11676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63802.exe
        7⤵
        
        PID:16780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26559.exe
        7⤵
        
        PID:10976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12237.exe
        6⤵
        
        PID:8060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62214.exe
        6⤵
        
        PID:13416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47208.exe
        6⤵
        
        PID:16612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3584.exe
        6⤵
        
        PID:18284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4676.exe
        5⤵
        
        PID:5360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39429.exe
        6⤵
        
        PID:8948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2296.exe
        6⤵
        
        PID:13180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8701.exe
        6⤵
        
        PID:17256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55905.exe
        5⤵
        
        PID:6972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17119.exe
        6⤵
        
        PID:16124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34913.exe
        5⤵
        
        PID:12568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26744.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56792.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56792.exe
      4⤵
      PID:2972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21034.exe
        5⤵
        
        PID:5700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26410.exe
        6⤵
        
        PID:7240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32547.exe
        7⤵
        
        PID:13300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54638.exe
        7⤵
        
        PID:16828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42605.exe
        6⤵
        
        PID:11664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51165.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60960.exe
        6⤵
        
        PID:5492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1137.exe
        5⤵
        
        PID:7316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62982.exe
        5⤵
        
        PID:14208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51578.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51578.exe
      4⤵
      PID:7048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21003.exe
        5⤵
        
        PID:9152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24711.exe
        6⤵
        
        PID:15604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47793.exe
        5⤵
        
        PID:13016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29696.exe
        5⤵
        
        PID:15948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55645.exe
        5⤵
        
        PID:12168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2124.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2124.exe
      4⤵
      PID:10140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-398.exe
        5⤵
        
        PID:16012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42633.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42633.exe
      4⤵
      PID:14604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9259.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9259.exe
      4⤵
      PID:1256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29606.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29606.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57411.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57411.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7390.exe
        5⤵
        
        PID:5628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29835.exe
        6⤵
        
        PID:7388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45694.exe
        7⤵
        
        PID:10584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49194.exe
        7⤵
        
        PID:15828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31909.exe
        7⤵
        
        PID:7804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28132.exe
        6⤵
        
        PID:10800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28440.exe
        6⤵
        
        PID:16560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61410.exe
        6⤵
        
        PID:16600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60960.exe
        6⤵
        
        PID:18316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10244.exe
        5⤵
        
        PID:7724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3824.exe
        5⤵
        
        PID:12056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19195.exe
        5⤵
        
        PID:17336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20197.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20197.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29835.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56363.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26661.exe
        6⤵
        
        PID:11148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41036.exe
        6⤵
        
        PID:15448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5169.exe
        5⤵
        
        PID:10244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17428.exe
        5⤵
        
        PID:14272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47477.exe
        5⤵
        
        PID:15400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23979.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23979.exe
      4⤵
      PID:7696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17119.exe
        5⤵
        
        PID:16140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11732.exe
        5⤵
        
        PID:5944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60042.exe
      4⤵
      PID:11456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63497.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63497.exe
      4⤵
      PID:15208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23428.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23428.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28060.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28060.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47162.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47162.exe
      4⤵
      PID:6136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52907.exe
        5⤵
        
        PID:8612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35545.exe
        5⤵
        
        PID:13552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58028.exe
        5⤵
        
        PID:18404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61717.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61717.exe
      4⤵
      PID:9784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22718.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22718.exe
      4⤵
      PID:13712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14597.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14597.exe
    3⤵
    PID:5748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42087.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42087.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55403.exe
        5⤵
        
        PID:9652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26661.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27148.exe
        5⤵
        
        PID:4472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62346.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62346.exe
      4⤵
      PID:9616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34690.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34690.exe
      4⤵
      PID:11132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49709.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49709.exe
      4⤵
      PID:16396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7813.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7813.exe
      4⤵
      PID:16736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23702.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23702.exe
    3⤵
    PID:8164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45450.exe
      4⤵
      PID:11448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17585.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17585.exe
      4⤵
      PID:17188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47185.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47185.exe
      4⤵
      PID:16428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13408.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13408.exe
      4⤵
      PID:18584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30376.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30376.exe
    3⤵
    PID:11500
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32008.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32008.exe
    3⤵
    PID:16748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46032.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46032.exe
    3⤵
    PID:1288
- C:\Users\Admin\AppData\Local\Temp\Unicorn-58386.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-58386.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19487.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19487.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31075.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31075.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12273.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58563.exe
        6⤵
        
        PID:396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36254.exe
        7⤵
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43239.exe
        8⤵
        
        PID:7464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41675.exe
        9⤵
        
        PID:13804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27300.exe
        9⤵
        
        PID:5056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14356.exe
        8⤵
        
        PID:12192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12256.exe
        8⤵
        
        PID:18140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21557.exe
        7⤵
        
        PID:8248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1144.exe
        7⤵
        
        PID:12972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6139.exe
        7⤵
        
        PID:16652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6404.exe
        6⤵
        
        PID:7140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16867.exe
        7⤵
        
        PID:10288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36365.exe
        7⤵
        
        PID:15400
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15400 -s 436
        8⤵
        Program crash
        
        PID:16452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46848.exe
        7⤵
        
        PID:17808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39756.exe
        6⤵
        
        PID:10820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37082.exe
        6⤵
        
        PID:15744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28696.exe
        5⤵
        
        PID:5280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58283.exe
        6⤵
        
        PID:1796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43239.exe
        7⤵
        
        PID:7652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59345.exe
        8⤵
        
        PID:18568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51542.exe
        7⤵
        
        PID:12036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20604.exe
        7⤵
        
        PID:15936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49350.exe
        7⤵
        
        PID:16684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21557.exe
        6⤵
        
        PID:8240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62406.exe
        6⤵
        
        PID:14236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39326.exe
        5⤵
        
        PID:7128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44495.exe
        6⤵
        
        PID:9932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36557.exe
        6⤵
        
        PID:15144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41612.exe
        6⤵
        
        PID:16280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17988.exe
        5⤵
        
        PID:10712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52210.exe
        6⤵
        
        PID:16396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11881.exe
        5⤵
        
        PID:15468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1837.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1837.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12486.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47162.exe
        6⤵
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15658.exe
        7⤵
        
        PID:8600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42243.exe
        8⤵
        
        PID:11460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17585.exe
        8⤵
        
        PID:17212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7596.exe
        8⤵
        
        PID:17692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59793.exe
        7⤵
        
        PID:11776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57937.exe
        7⤵
        
        PID:16416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61717.exe
        6⤵
        
        PID:9632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46262.exe
        6⤵
        
        PID:14260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8676.exe
        6⤵
        
        PID:17404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20197.exe
        5⤵
        
        PID:5764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28766.exe
        6⤵
        
        PID:7468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12318.exe
        7⤵
        
        PID:12404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22012.exe
        7⤵
        
        PID:17876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8397.exe
        6⤵
        
        PID:8736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11476.exe
        6⤵
        
        PID:17384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41566.exe
        6⤵
        
        PID:4944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25972.exe
        5⤵
        
        PID:3220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33071.exe
        6⤵
        
        PID:15276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18312.exe
        6⤵
        
        PID:18496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12704.exe
        5⤵
        
        PID:12132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23005.exe
        5⤵
        
        PID:6516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47197.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47197.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22767.exe
        5⤵
        
        PID:5424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29835.exe
        6⤵
        
        PID:7368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6921.exe
        7⤵
        
        PID:15988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62642.exe
        6⤵
        
        PID:10280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48360.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19481.exe
        5⤵
        
        PID:7892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60307.exe
        6⤵
        
        PID:12424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15961.exe
        6⤵
        
        PID:17380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63760.exe
        6⤵
        
        PID:18364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62214.exe
        5⤵
        
        PID:13408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35488.exe
        5⤵
        
        PID:17412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19377.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19377.exe
      4⤵
      PID:5600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39591.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8042.exe
        6⤵
        
        PID:12548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7053.exe
        5⤵
        
        PID:10704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1559.exe
        5⤵
        
        PID:15268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28112.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28112.exe
      4⤵
      PID:7256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7933.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62038.exe
        5⤵
        
        PID:16660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17104.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17104.exe
      4⤵
      PID:10484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4982.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4982.exe
      4⤵
      PID:15568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27177.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27177.exe
      4⤵
      PID:2824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56326.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56326.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45247.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45247.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60618.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7390.exe
        6⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29835.exe
        7⤵
        
        PID:7548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3081.exe
        8⤵
        
        PID:11820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38104.exe
        8⤵
        
        PID:1664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62214.exe
        7⤵
        
        PID:13356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19481.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17119.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7840.exe
        7⤵
        
        PID:336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62214.exe
        6⤵
        
        PID:13392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44424.exe
        6⤵
        
        PID:15012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15044.exe
        5⤵
        
        PID:5724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30655.exe
        6⤵
        
        PID:6680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41999.exe
        7⤵
        
        PID:9164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7829.exe
        7⤵
        
        PID:12928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2644.exe
        7⤵
        
        PID:15884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49134.exe
        6⤵
        
        PID:10036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37273.exe
        6⤵
        
        PID:13812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61301.exe
        6⤵
        
        PID:16464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10108.exe
        5⤵
        
        PID:6108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55403.exe
        6⤵
        
        PID:9660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26661.exe
        6⤵
        
        PID:13544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16409.exe
        5⤵
        
        PID:9536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63144.exe
        5⤵
        
        PID:13260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34325.exe
        5⤵
        
        PID:17120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56638.exe
        5⤵
        
        PID:9076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11972.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29866.exe
        5⤵
        
        PID:5560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42087.exe
        6⤵
        
        PID:7488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45450.exe
        7⤵
        
        PID:11432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16324.exe
        7⤵
        
        PID:17080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32101.exe
        7⤵
        
        PID:17736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62214.exe
        6⤵
        
        PID:13424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22276.exe
        6⤵
        
        PID:17260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12237.exe
        5⤵
        
        PID:3232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9194.exe
        6⤵
        
        PID:12160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41612.exe
        6⤵
        
        PID:16800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62214.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6324.exe
        5⤵
        
        PID:4336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57560.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57560.exe
      4⤵
      PID:5692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21226.exe
        5⤵
        
        PID:6612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15658.exe
        6⤵
        
        PID:8640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45263.exe
        7⤵
        
        PID:9812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23044.exe
        7⤵
        
        PID:15196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1784.exe
        7⤵
        
        PID:3724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27665.exe
        6⤵
        
        PID:4880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7252.exe
        6⤵
        
        PID:15584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44424.exe
        6⤵
        
        PID:18276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37379.exe
        5⤵
        
        PID:10300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57820.exe
        5⤵
        
        PID:16412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59762.exe
        5⤵
        
        PID:16552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15973.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15973.exe
      4⤵
      PID:5384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55403.exe
        5⤵
        
        PID:9724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30745.exe
        5⤵
        
        PID:7880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-149.exe
        5⤵
        
        PID:17392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37607.exe
        5⤵
        
        PID:5344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7744.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7744.exe
      4⤵
      PID:9592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26555.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26555.exe
      4⤵
      PID:16048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58972.exe
      4⤵
      PID:16872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27824.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27824.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26851.exe
        5⤵
        
        PID:5460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21226.exe
        6⤵
        
        PID:6628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25471.exe
        7⤵
        
        PID:9012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64199.exe
        8⤵
        
        PID:12184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4332.exe
        8⤵
        
        PID:17588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40057.exe
        7⤵
        
        PID:12396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30373.exe
        7⤵
        
        PID:17368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16077.exe
        6⤵
        
        PID:9924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25022.exe
        6⤵
        
        PID:16028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52341.exe
        5⤵
        
        PID:8472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49459.exe
        6⤵
        
        PID:13252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54824.exe
        6⤵
        
        PID:17820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51377.exe
        5⤵
        
        PID:11524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8944.exe
        5⤵
        
        PID:16808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44770.exe
        5⤵
        
        PID:5912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65314.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65314.exe
      4⤵
      PID:5596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39591.exe
        5⤵
        
        PID:7084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23499.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18000.exe
        6⤵
        
        PID:14896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60533.exe
        6⤵
        
        PID:16264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62346.exe
        5⤵
        
        PID:9432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-407.exe
        5⤵
        
        PID:15324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51945.exe
        5⤵
        
        PID:16676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43933.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43933.exe
      4⤵
      PID:7712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26815.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1559.exe
        5⤵
        
        PID:15260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52481.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52481.exe
      4⤵
      PID:10352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33979.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33979.exe
      4⤵
      PID:15092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36726.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36726.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11474.exe
      4⤵
      PID:5672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25310.exe
        5⤵
        
        PID:6572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10649.exe
        6⤵
        
        PID:8928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2296.exe
        6⤵
        
        PID:13188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46901.exe
        6⤵
        
        PID:16612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38085.exe
        5⤵
        
        PID:7424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13898.exe
        6⤵
        
        PID:10616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24881.exe
        6⤵
        
        PID:15888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2883.exe
        6⤵
        
        PID:18060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55189.exe
        5⤵
        
        PID:10640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46750.exe
        5⤵
        
        PID:16792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30252.exe
        5⤵
        
        PID:17252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61910.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61910.exe
      4⤵
      PID:6112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55870.exe
        5⤵
        
        PID:10164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36557.exe
        5⤵
        
        PID:15136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57745.exe
        5⤵
        
        PID:17156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48437.exe
        5⤵
        
        PID:5860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36550.exe
      4⤵
      PID:5020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31260.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31260.exe
      4⤵
      PID:16964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25694.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25694.exe
      4⤵
      PID:18444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25979.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25979.exe
    3⤵
    PID:5720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21226.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21226.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39429.exe
        5⤵
        
        PID:8976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34475.exe
        5⤵
        
        PID:13696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58506.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58506.exe
      4⤵
      PID:9212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33131.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33131.exe
      4⤵
      PID:12532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4472.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4472.exe
      4⤵
      PID:17988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54190.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54190.exe
    3⤵
    PID:7904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26815.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26815.exe
      4⤵
      PID:10060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26661.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26661.exe
      4⤵
      PID:12612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59729.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59729.exe
      4⤵
      PID:16664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22815.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22815.exe
    3⤵
    PID:10364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7644.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7644.exe
    3⤵
    PID:15188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61793.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61793.exe
    3⤵
    PID:1016
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40876.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40876.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18823.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18823.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28312.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28312.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12242.exe
        5⤵
        
        PID:2296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39591.exe
        6⤵
        
        PID:7096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27007.exe
        7⤵
        
        PID:9264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46133.exe
        8⤵
        
        PID:18156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10133.exe
        7⤵
        
        PID:14172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62346.exe
        6⤵
        
        PID:9908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46017.exe
        6⤵
        
        PID:15220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35801.exe
        6⤵
        
        PID:1792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9969.exe
        5⤵
        
        PID:7268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55403.exe
        6⤵
        
        PID:9704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47082.exe
        6⤵
        
        PID:12384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10544.exe
        5⤵
        
        PID:3876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47167.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64193.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64193.exe
      4⤵
      PID:1576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39591.exe
        5⤵
        
        PID:7104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19934.exe
        6⤵
        
        PID:8464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31535.exe
        7⤵
        
        PID:14372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54482.exe
        6⤵
        
        PID:13764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3028.exe
        6⤵
        
        PID:16724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2372.exe
        5⤵
        
        PID:10196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31735.exe
        5⤵
        
        PID:14884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47477.exe
        5⤵
        
        PID:15768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33156.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33156.exe
      4⤵
      PID:7352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21875.exe
        5⤵
        
        PID:10608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44424.exe
        5⤵
        
        PID:8708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64250.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64250.exe
      4⤵
      PID:10600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26300.exe
      4⤵
      PID:17364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7112.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7112.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:18436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1837.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1837.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15418.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15418.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22959.exe
        5⤵
        
        PID:4492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49658.exe
        6⤵
        
        PID:6432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55403.exe
        7⤵
        
        PID:9712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26661.exe
        7⤵
        
        PID:13616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27148.exe
        7⤵
        
        PID:16392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10544.exe
        6⤵
        
        PID:9608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42645.exe
        6⤵
        
        PID:15288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15267.exe
        6⤵
        
        PID:17612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61910.exe
        5⤵
        
        PID:6188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54827.exe
        6⤵
        
        PID:8752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52946.exe
        6⤵
        
        PID:13000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63713.exe
        6⤵
        
        PID:16460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23933.exe
        6⤵
        
        PID:17600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16107.exe
        5⤵
        
        PID:10188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37601.exe
        5⤵
        
        PID:14876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18967.exe
        5⤵
        
        PID:5236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6985.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6985.exe
      4⤵
      PID:5436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42087.exe
        5⤵
        
        PID:7456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56363.exe
        6⤵
        
        PID:9844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26661.exe
        6⤵
        
        PID:13992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5169.exe
        5⤵
        
        PID:9548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40191.exe
        6⤵
        
        PID:17116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42001.exe
        6⤵
        
        PID:16500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17428.exe
        5⤵
        
        PID:14416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28017.exe
        5⤵
        
        PID:17652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25972.exe
      4⤵
      PID:8068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40715.exe
        5⤵
        
        PID:13272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54638.exe
        5⤵
        
        PID:17172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60042.exe
      4⤵
      PID:11320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9832.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9832.exe
      4⤵
      PID:15208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25816.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25816.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2538.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2538.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18019.exe
        5⤵
        
        PID:5268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58527.exe
        6⤵
        
        PID:9112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19396.exe
        6⤵
        
        PID:12540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18067.exe
        6⤵
        
        PID:17624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61386.exe
        5⤵
        
        PID:9988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40397.exe
        5⤵
        
        PID:14004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19351.exe
        5⤵
        
        PID:17680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31977.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31977.exe
      4⤵
      PID:7064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27007.exe
        5⤵
        
        PID:9252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29231.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18067.exe
        6⤵
        
        PID:17660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22385.exe
        5⤵
        
        PID:14128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35701.exe
        5⤵
        
        PID:17352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10544.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10544.exe
      4⤵
      PID:9456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56350.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56350.exe
      4⤵
      PID:13736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65189.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65189.exe
      4⤵
      PID:16524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48508.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48508.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:18180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26586.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26586.exe
    3⤵
    PID:5452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29835.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29835.exe
      4⤵
      PID:7360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24947.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60252.exe
        5⤵
        
        PID:17888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62642.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62642.exe
      4⤵
      PID:8992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61388.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61388.exe
      4⤵
      PID:16716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21179.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21179.exe
    3⤵
    PID:7628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54607.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54607.exe
      4⤵
      PID:16100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28487.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28487.exe
      4⤵
      PID:17208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50026.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50026.exe
    3⤵
    PID:12072
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10389.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10389.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45247.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45247.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31755.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31755.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29098.exe
        5⤵
        
        PID:2896
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 720
        6⤵
        Program crash
        
        PID:7028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56460.exe
        5⤵
        
        PID:7920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45450.exe
        6⤵
        
        PID:11424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17585.exe
        6⤵
        
        PID:17204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10620.exe
        6⤵
        
        PID:15256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54230.exe
        5⤵
        
        PID:10736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16076.exe
        5⤵
        
        PID:17092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63729.exe
        5⤵
        
        PID:17328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2901.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2901.exe
      4⤵
      PID:5412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29835.exe
        5⤵
        
        PID:7408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26815.exe
        6⤵
        
        PID:10076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44171.exe
        7⤵
        
        PID:15224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29412.exe
        7⤵
        
        PID:4752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1559.exe
        6⤵
        
        PID:15736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37913.exe
        6⤵
        
        PID:17720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62205.exe
        5⤵
        
        PID:1272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13117.exe
        5⤵
        
        PID:6936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32220.exe
        5⤵
        
        PID:17324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23979.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23979.exe
      4⤵
      PID:7644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6921.exe
        5⤵
        
        PID:15996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60042.exe
      4⤵
      PID:11396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63693.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63693.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39600.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39600.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38335.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38335.exe
      4⤵
      PID:1872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18019.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31179.exe
        6⤵
        
        PID:7296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38271.exe
        7⤵
        
        PID:16232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39157.exe
        7⤵
        
        PID:16660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44388.exe
        7⤵
        
        PID:560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58641.exe
        6⤵
        
        PID:12216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38812.exe
        6⤵
        
        PID:11132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59361.exe
        5⤵
        
        PID:9448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56158.exe
        5⤵
        
        PID:15116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11365.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11365.exe
      4⤵
      PID:6960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56991.exe
        5⤵
        
        PID:7196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1838.exe
        6⤵
        
        PID:10772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17481.exe
        6⤵
        
        PID:15512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7543.exe
        6⤵
        
        PID:18560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56529.exe
        5⤵
        
        PID:10580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63034.exe
        5⤵
        
        PID:16068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58841.exe
        5⤵
        
        PID:16724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42584.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42584.exe
      4⤵
      PID:8044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1856.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1856.exe
      4⤵
      PID:12940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60913.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60913.exe
      4⤵
      PID:15112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-108.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-108.exe
    3⤵
    PID:5324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34739.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34739.exe
      4⤵
      PID:6700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28211.exe
        5⤵
        
        PID:1564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9194.exe
        6⤵
        
        PID:11760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50170.exe
        6⤵
        
        PID:16456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63760.exe
        6⤵
        
        PID:18352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40441.exe
        5⤵
        
        PID:11476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61144.exe
        5⤵
        
        PID:16692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47477.exe
        5⤵
        
        PID:5796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58506.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58506.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40170.exe
        5⤵
        
        PID:15216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9888.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9888.exe
      4⤵
      PID:12676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26854.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26854.exe
      4⤵
      PID:2492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31603.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31603.exe
      4⤵
      PID:16916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15973.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15973.exe
    3⤵
    PID:1164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55403.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55403.exe
      4⤵
      PID:9680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26661.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26661.exe
      4⤵
      PID:13452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7744.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7744.exe
    3⤵
    PID:6296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26555.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26555.exe
    3⤵
    PID:16300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58396.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58396.exe
    3⤵
    PID:16884
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25024.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25024.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7442.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7442.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34827.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34827.exe
      4⤵
      PID:5296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13550.exe
        5⤵
        
        PID:6176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58698.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21255.exe
        7⤵
        
        PID:13608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53864.exe
        7⤵
        
        PID:4576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61957.exe
        6⤵
        
        PID:11740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9839.exe
        6⤵
        
        PID:16576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28848.exe
        5⤵
        
        PID:8200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61528.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8125.exe
        5⤵
        
        PID:16160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5563.exe
        5⤵
        
        PID:4300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45980.exe
      4⤵
      PID:9376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46439.exe
        5⤵
        
        PID:16068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59821.exe
        5⤵
        
        PID:14972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4088.exe
        5⤵
        
        PID:5148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11440.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11440.exe
      4⤵
      PID:13136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53275.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53275.exe
      4⤵
      PID:15944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39959.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39959.exe
      4⤵
      PID:5336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27405.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27405.exe
    3⤵
    PID:5528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42087.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42087.exe
      4⤵
      PID:7520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26815.exe
        5⤵
        
        PID:10068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26661.exe
        5⤵
        
        PID:13632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55929.exe
        5⤵
        
        PID:17168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65361.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65361.exe
      4⤵
      PID:10104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17428.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17428.exe
      4⤵
      PID:14720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25972.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25972.exe
    3⤵
    PID:8140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22902.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22902.exe
    3⤵
    PID:12280
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18733.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18733.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39487.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39487.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21034.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21034.exe
      4⤵
      PID:5644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15658.exe
        5⤵
        
        PID:8632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40606.exe
        6⤵
        
        PID:13684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63760.exe
        6⤵
        
        PID:18372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43950.exe
        5⤵
        
        PID:11800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59153.exe
        5⤵
        
        PID:16236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37379.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37379.exe
      4⤵
      PID:10316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13772.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13772.exe
      4⤵
      PID:16052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59995.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59995.exe
      4⤵
      PID:6008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31977.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31977.exe
    3⤵
    PID:7072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50411.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50411.exe
      4⤵
      PID:11588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26043.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26043.exe
      4⤵
      PID:5872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20788.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20788.exe
    3⤵
    PID:10720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37082.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37082.exe
    3⤵
    PID:15724
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38871.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38871.exe
  2⤵
  PID:5512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21226.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21226.exe
    3⤵
    PID:6604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54827.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54827.exe
      4⤵
      PID:8744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57990.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57990.exe
      4⤵
      PID:12444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7543.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7543.exe
      4⤵
      PID:18608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63825.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63825.exe
    3⤵
    PID:10228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24874.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24874.exe
    3⤵
    PID:11104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31260.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31260.exe
    3⤵
    PID:16952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40485.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40485.exe
    3⤵
    PID:16468
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30355.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30355.exe
  2⤵
  PID:6424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49534.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49534.exe
    3⤵
    PID:11368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21995.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21995.exe
    3⤵
    PID:16768
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48637.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48637.exe
  2⤵
  PID:10948
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47853.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47853.exe
  2⤵
  PID:15464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2896 -ip 2896
1⤵
PID:6452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 180 -p 6212 -ip 6212
1⤵
PID:8760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 7596 -ip 7596
1⤵
PID:11252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 6516 -ip 6516
1⤵
PID:12736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 6516 -ip 6516
1⤵
PID:16336

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:18120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10389.exe

Filesize
468KB

MD5
9ce3ba6f4e7d386de50ed831ef9baf10

SHA1
fca2d59e8003a89e9b509c85fe72168d4c1b8f0f

SHA256
391fc6f4e6496bfc369d74268b4a698529adb638a48822c6463a6fc9ce67f951

SHA512
90c1d98f94eff7bb3eaa9aa9a328d666625520f3e8fa6e49552838d25228020580d0987cb7801b98f9420313d3604d5f91e6a4d83c3a1d8921d40e4aa45ac79b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15241.exe

Filesize
468KB

MD5
ed1ed8f627a130fed018b43ba8e7ca3d

SHA1
0805ebf81001aa7341bb48b62634213bb6710267

SHA256
178d315a882b84e13ab50661be19314b849ba42fd978e3baf2c9df480a9b12ad

SHA512
26014bce32bb31c442efbbc6204cbd79bf09e45c5118ed9af369797c15b3d029a29a229348e2f88293c03b46ebf94120d204650fee3b0641e2292ded97bb21fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1837.exe

Filesize
468KB

MD5
b566de3cc9ab81114d7381ac162af6cd

SHA1
7d5d35c5d7ec56b717d7ddddc0906cc32bfeb369

SHA256
2b7c0fa350aa6ec43113d903be23297df78a2806aedaad80f2bdeb7e2eecdbe2

SHA512
31649589a64d9c16f40c5a31a3de8c7765a9121050a1de8fb722da69221a7d1cbf63d9f0f38d12eb5352b7243c300a2d914c9d006b96a9f0927164ca4583b66c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18823.exe

Filesize
468KB

MD5
9cf182b6a7101a348270ddeb39edfd93

SHA1
f7108faa731230c108c6cecab96914a8781f3545

SHA256
c1c9dc1f865bc9ee3a9f06b279afe306536e325a41793f644038fcc6ec2e4b51

SHA512
5b2c0c45265ec9b0137eec04a2cd4bc3af966362b1a73af0cd341f6099f440125b5a73f4f4c8d23db788e0d45a1f5b24431901790bbfc8100b38d0f543db3df4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19487.exe

Filesize
468KB

MD5
f3bffdd3a4b1f26995d0dff81acf634d

SHA1
bff6e77c8a9f85c347355a8d7925cc61d0be4b56

SHA256
817b1850ddaf521d3f3dba5ef2017cbf6ffd49398119439d592356d8bc670ec9

SHA512
ea19e8bd2503e77372caf1bd9060097107a42a6572cbfc5a20f17f1c4178eec4defd674c6424ae73a4a19db5f1098ce6081dbf4fb44952fb1697306ef14f8c7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23269.exe

Filesize
468KB

MD5
0618d6d67334527e807871c85d206759

SHA1
f99e7c80afce8cf47c5e5b294540b177afe5cf8b

SHA256
6b460529ec70bae8aa0075e45e448cc655f089924e1c5320fe5392495eb52144

SHA512
bd61c55c782fba44803cc877cd5abdc3c7fb8a2e97cda76f4696556af4a4bd20425fca273d6d1ad5749641a454713220568ab5ebb2a392ac9088585f6515d660

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25024.exe

Filesize
468KB

MD5
358665c317b8976e569bb5ccb6b56a9e

SHA1
238d7fefb575811a54dc14e09f21613459ec7904

SHA256
1d42b396a8faba1a06fd5fbb7fdd87b60d8bf45655a4e0bdacccdb5a515b7f58

SHA512
4dff16bfaf33222e214130f98d61f63e439fab7e60ed590c532d9a91e20e0e1e2d455ff2a5e8981ae59b97e02a3c4d79185358bacc41f3b1f2fa3eb9c590865e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27824.exe

Filesize
468KB

MD5
355151bf16f152bc7b0f68f1266cf051

SHA1
9a58752c4d1c1079ccf51c87f74ec7bae4483d26

SHA256
e6d2495b0fa107ca68d3604eca241cea7b605057aa6d62fd9cf359d7fed7cbb4

SHA512
2a96d34f1f3e499262c0d0ede0b6030068c33b958e65f2699d529873103b7e12f542d2c49e56dc03966ae4a925f85bfb919d7bf4d2dc3938a38527c6c3e5f794

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29606.exe

Filesize
468KB

MD5
f09e42ea44501e5d234df03f71c8a2f0

SHA1
c7e45ace783188acb8e1d222e7f88a770cd24de7

SHA256
eb9f51ead818c9373f666888849fe7d39790239c660ecb802caa0692caa8e06d

SHA512
742d281a8cd8360e38105754ac2e24f06839f200038cfeea46d3d4d46148df3dd00043e481ed7c314e4d2543b903544034d6b6fc42ea0d80e0bac94549d97e82

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31075.exe

Filesize
468KB

MD5
0f9fbd35d1a175c7ca0880158103c120

SHA1
cada87fcaf35f8bf8508dd87d7b7a325bde5e2ce

SHA256
58bd9f69a1b1c5a89bdad52c125b51f43c956fe00556b9e591c86cab1ed4d784

SHA512
4d2e685c43a303ced883e568f3960ec99043cf3e857f02c4ee1415e1ba1fe5f08cdefa65d8a2be96703e486201384dd59b73bfd860c3d83d1984ecb390d88743

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33112.exe

Filesize
468KB

MD5
f75d7a25382b5b3548a0e194357223bf

SHA1
5756c982f81877fbea4606079fe46b6bc887f16d

SHA256
243729320a5093bd09021bd152ae7ded899fe7c5d34b5560aba28a808bdf17e5

SHA512
ecc6b29431b962f134e5bca04239db44b78f5739e7337aa80bf1b8a251b77cd864676aed1fcbaf7dd063f203faf9b057550d4d9e94ce789ee732608e809f021e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33379.exe

Filesize
468KB

MD5
f2d1d2dcdd7e8dbc62a57ac6fa51bf2f

SHA1
25acab3d4f94657999a1f08c4df5fbc59997a49a

SHA256
0dee9a6f77f8264b5f132b91082e9a73a793d7c6df7d43caa06225afa38de299

SHA512
d930403e8c593d5c0b988e9aebfcba55ca61078942511406f2135115459b2375febf3f3a7e178060ceebc521c4850730863700460134a1d8894bff9271e03b24

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3403.exe

Filesize
468KB

MD5
e91292fbc3788d8d7fc45d9d9f58af67

SHA1
d8fb581c033104c64688acb6a010d9ecbb91f645

SHA256
dad2db19fc1f862af652793470ad81c641f4d8bfca4c259c98af9739f77ec7e9

SHA512
dadec184c497e4432105b8e179f5487e25ce17d2c5c462f0d0b9dd4e6078fdd1a2d60fbf2b18fb90e1e5fa16342a6051047a7ea5f182fd0a3e3adccee290c2eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35107.exe

Filesize
468KB

MD5
ff3239ca78a92893552a563b6d4d58c0

SHA1
51e9cc8735f33ed7166ca02fdfe0a2c4746fab91

SHA256
7952ae6b40017a9e7895087083c37a650385a9dff4ac5d49fe139f7d147dc4d0

SHA512
153ff097ea81df452f30bd5e561f30beb13267e64a3c53a18d55fd96aadad65309357b5793b09703cca30db3f231a8d6206a6c4bd436ebd0fbd630cfc50434dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36010.exe

Filesize
468KB

MD5
efa51b9892f1594fa13573e22f7672fb

SHA1
e071348969a6efabdca29bc14402974ab441b22f

SHA256
e345969f9db2e4290baef68b4f4554c653853c970f2b8d4a0751986ded4a46e5

SHA512
f73f057da5e1d547f177cb86ec95d16be3a8183a04e950c964448bfcfb8c2de016cdebb0b620433fdf57417f4555fa476f08f41bdb469d13d2cb3a4f7db2010b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38925.exe

Filesize
468KB

MD5
b7c05bee04cd660bda5ffe9ee2c511e2

SHA1
cc9644fac25b18ae2a94564edbc44540e4f3d7a4

SHA256
d08f328731fc8fae9e48313fc5f8fc2812ba5be3c73702c88a68e649680ef63f

SHA512
8c202612485e39901793f7ac24b3b5700b266d464c5a87cfdf74a04fbbb71f2228770d6674978ae93bda81c1addf8f5d558b4999774fd5834c5560f4b84255e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39243.exe

Filesize
468KB

MD5
a90120ab10895f75b5b072b037000307

SHA1
75f73e1e0569215bb70931e5674b5621f4fd4b9b

SHA256
e47d39631fe385941da9a549a71a8d67cf2711069e838d7e492a66886a5a5feb

SHA512
75ad89547f3ebefc9656ed458b5e0f1c5e05d03468dc0d7604b10764913abf24cb04fd32281b21d2c9cfe2e7cef81e08e0f6c1ba5187686a9c061c001c128ac0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39907.exe

Filesize
468KB

MD5
a73a45082ad2ac2d84f916227459dd60

SHA1
12a80d77ac9b57d46db3eee0d235263bceac7ea9

SHA256
ed79b8cb758745973f5d0a18d36946baf6e89ea337a7414a2e631b9ad954fe0b

SHA512
cd2e824249b811839f5eb154769c50060397d2c7e2c20859d2fb7f1ae4c81f70590940730315d044c963ce69134d0b0fde3c9a5c8b7748b89f601fe42cce046f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40876.exe

Filesize
468KB

MD5
ba55c4ce5887e445d4c3325da5331abe

SHA1
9be20e281e635a6a124c3001d02dd35820870f3b

SHA256
cba14ae48ff4b1f4337ffa32189cb117efd301fdc4ba7b6f7da29c7fcc324344

SHA512
d0239354f07efdd3ec2ed8e24c7e1b87a98acddbbe2ff05c4a8e864295be78d4c3ed89a5a6659927034945a83c778a9b863bb5327da649292f1d118e69f28e0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43275.exe

Filesize
468KB

MD5
64c70752daef23422b9312dc1a706a23

SHA1
df7be3305fd804574260375eb20b8647108e260b

SHA256
12ffa324407c2ad568666926caa6905539f6dcd59b0dd65be062c29f4edccf6f

SHA512
2f24b40e742fe3c43c3af9894adeb2c34d6eb1942a5af4384edf42eaeedb9ab713ade041493c430713acb1d7b9e2b5484c712dee3b9f313c90a190a32c6ccc40

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45247.exe

Filesize
468KB

MD5
c017ec0740f1831311a87ec48b59dc4c

SHA1
507ca97ab346365ab6ef02d71a0db8cd9c470f3c

SHA256
4608a90332f6a22b819d2230a40b60050f115a65b8f110fb3392c3a574c0f3a3

SHA512
1039826cc4981e11fc6410ef70bc81816123279f13370ee7d9776ee71bcb3ed9483a89925db0317bb2255eb82ee30f6af6e7cc3201af2b586e194bc272a4ff20

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50986.exe

Filesize
468KB

MD5
3fdc919281d0cbaf9f35388509ce490a

SHA1
920748544d44201d451853b6c567dba71aa67863

SHA256
d4be89ed18ba813a5af22c461014d3fd57a09542b2a8c1f21a8c63aa3479d6c8

SHA512
2da8e0a9cd99900b851a8dc08e3d32aa9c0dd5545ff458eed1477945f2712c201437c78a48bd52bba52034812367de5df47588b2714ea2987def05d63d61d25e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53477.exe

Filesize
468KB

MD5
dc2b034e9a678042cff86f6b7d6d1b4d

SHA1
70572ee13d905bbce76818c014ce5fa3a7d8b365

SHA256
65d63a7a12d3b2f0d8ec6f62951edf87e1b230ac00a0cbc1bb729fcc0be4acac

SHA512
70d5eddb53142c0a2d6f2b9f623c3f87edccb2569ff72f1632212786ce28b6803ede2f5517ba589210f9c225a688726030caef48e12bf890f691aad502edc160

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56326.exe

Filesize
468KB

MD5
ce61d7bc653e9d139214f43af7d483cc

SHA1
59020b88ac12c1548f1ef210e71b777ba05dc046

SHA256
b5b953a42e1235ce60acee28aea54f9c0fb424225e75ee49b13278dc29f31322

SHA512
94b284a613bd2a9effde08f48feca7d32535086d1087e178a33c785de1414c0522450b2c8fb91750f86e1c51487fd44cd687cc0f57223a11f930402f9ff59f04

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58386.exe

Filesize
468KB

MD5
7fbc9e4e8a0fa41413ea0375de54e474

SHA1
f0e283208fa94075e803499fdd5d979e46f957ae

SHA256
154e4409653ff83ba6b2419dbb35699a6b3f3c32ef95cdce36ee4f8e4e50ec81

SHA512
2d3ae625f15a293295a253c1e8ab1adc03975e951f62092369651fbcd067ca99af743231e4e16dec600ac15dab3c9bfd45cc4b5f46da384fbcfe9baef7b65a19

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60005.exe

Filesize
468KB

MD5
943dae4dc665ef1d7d3681c9623f0306

SHA1
5efbd481c695623b6872ab9162bf36ad38f6fc67

SHA256
4f4a1f4789d1f3ad91f54518ec0dee47de6389ab87c191a9f01ec3c572b44be3

SHA512
5a2198f1ed531b6cd490c955c74838dc0fbb5fe557a58d295989560fe12277a37f57db29461d6f56b39dcff9af49e5d86fdcf0049abffcb4587b28fda00c7511

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61391.exe

Filesize
468KB

MD5
9d75b0f6d9c7fa5c1cdcae3ea6599df6

SHA1
cf9e4d5ffd10505b4c68549540ead69859cb4782

SHA256
2dc0cd89c5cb25614ca93b5cf51bcd76a3e6605b4581add125b739c5104a1dfe

SHA512
29017121747077797f64241766951cf9c677af8c22de4ea0385129ffd92504ef7087a72fe5bf159f66dfcae344b6a73a00653c2ebb6492748ddfe3c2cd4635ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63555.exe

Filesize
468KB

MD5
60081ab5da179328903739d7d16082d3

SHA1
e0aca9daa274cabdf32b2f8807fab3a415e000bc

SHA256
7febfcce6e42d1f91d4f5b9a7fc928a9fb1134bf6410c5380b90c92e342e8905

SHA512
054771cf6047dcd8a4c1ff43a1326cd74eeae12aa8b3df25a8ffbdca4bc5cf586c76c3b1cb2de17d3f6298786ced7a72a6922a0abd973c28cc7cef5124373f82

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6967.exe

Filesize
468KB

MD5
92f19dbbee63f1ac14a09d3a95202075

SHA1
b000caed2ee167c3ddb0e3c5451f4fbb1aa0387c

SHA256
6e7bee5ed2250e110c928ec1e33c1ae99d4328f1123d9260b8baa487837a1e46

SHA512
9d5b7813bed9dd2a04e7c0e8dd4984d04a831b92bf1e411d7c48c70806fd011fb73c2276c6275fdd18cfa97a40853619c31d7bcd7c1c2414a2b1754f533cb525

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7753.exe

Filesize
468KB

MD5
f3cf1bcd72eeb8c84da44d3c3edf1d65

SHA1
651541f12f42c52aeb6a20deb959023ad51b2399

SHA256
fd46275334693697d4bbcd1e7ff13d4937d4bd28e86dd550d6d46ff008879df4

SHA512
c5daf38ab951a23e59b3011c53bc81bfbb73b951e9bca82c342b9e4682c717e0db868aba71b5f684cbfd673394cc215d421b8023f91f208810423cc1a0cf17ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8298.exe

Filesize
468KB

MD5
45a15e1249af9bda71a11ccdbe47b4fc

SHA1
a89f3e6a3dd8979503a24176af2539ce21c1deed

SHA256
e99595e8d85d83993e6f8e1f5db0fb1d8bfac39909baae82adc41bf1f64b7ee9

SHA512
cb8cd2e4c61c158da809a87a55a3288d3679d22a8538cc4addcfe77b298be56a1f890680697f4e64d382d03b053955669eb05ea175e9cd76102c3ecfcf671348

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads