a5953bf8d4de320b33d078ddc820b020a3c2f401338bf5449254108090d5e133

Analysis

max time kernel
150s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
14-10-2024 22:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

44848eaa59859fdf1d3d91ea7bb3310f_JaffaCakes118.exe
Size

188KB
MD5

44848eaa59859fdf1d3d91ea7bb3310f
SHA1

dbdeb2767c68a0a094dcd153818f6fe9301880f4
SHA256

a5953bf8d4de320b33d078ddc820b020a3c2f401338bf5449254108090d5e133
SHA512

e8d1b51a51aabedac2867bb1e4ed163ad4c9a154ca7a5730e2f572f809b54a113296ab5a8e2dd256fbecfc6e8930f00b2bae1151908f6ba0aea4da709ada3172
SSDEEP

3072:TtyHoKeYtAHYOFyddIXDzdrTvx6c3ymGSYx8hPz97lPdzFs:TtKo+aHYndCXDzFV7D7lPdzF

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2256	Unicorn-56573.exe
2260	Unicorn-14746.exe
2236	Unicorn-25607.exe
2876	Unicorn-43574.exe
2644	Unicorn-4487.exe
2728	Unicorn-46075.exe
2688	Unicorn-18961.exe
1700	Unicorn-21653.exe
2508	Unicorn-2624.exe
2964	Unicorn-64077.exe
2980	Unicorn-40127.exe
536	Unicorn-42671.exe
588	Unicorn-14637.exe
1952	Unicorn-44617.exe
2492	Unicorn-5722.exe
1088	Unicorn-12499.exe
916	Unicorn-32365.exe
2544	Unicorn-20689.exe
1488	Unicorn-31549.exe
2076	Unicorn-18250.exe
1512	Unicorn-40616.exe
2316	Unicorn-20750.exe
1572	Unicorn-20196.exe
1548	Unicorn-15296.exe
1596	Unicorn-31078.exe
1616	Unicorn-6381.exe
1880	Unicorn-41192.exe
2292	Unicorn-59666.exe
2320	Unicorn-31632.exe
876	Unicorn-51498.exe
1272	Unicorn-23272.exe
2588	Unicorn-34669.exe
2788	Unicorn-22993.exe
1296	Unicorn-3127.exe
2192	Unicorn-49635.exe
2652	Unicorn-17517.exe
2760	Unicorn-64025.exe
2860	Unicorn-43413.exe
2540	Unicorn-27631.exe
2520	Unicorn-41275.exe
2548	Unicorn-41275.exe
2556	Unicorn-4881.exe
2524	Unicorn-16579.exe
540	Unicorn-51389.exe
1632	Unicorn-11103.exe
1460	Unicorn-27461.exe
1680	Unicorn-60880.exe
2764	Unicorn-28747.exe
1496	Unicorn-36361.exe
2276	Unicorn-11664.exe
1592	Unicorn-45084.exe
2144	Unicorn-56781.exe
2876	Unicorn-17887.exe
604	Unicorn-47030.exe
2060	Unicorn-57912.exe
1092	Unicorn-30715.exe
1664	Unicorn-39952.exe
1676	Unicorn-39952.exe
1996	Unicorn-52759.exe
2052	Unicorn-22909.exe
1560	Unicorn-32146.exe
1888	Unicorn-65333.exe
1940	Unicorn-46345.exe
2240	Unicorn-23232.exe

Loads dropped DLL 64 IoCs

pid	Process
848	44848eaa59859fdf1d3d91ea7bb3310f_JaffaCakes118.exe
848	44848eaa59859fdf1d3d91ea7bb3310f_JaffaCakes118.exe
2256	Unicorn-56573.exe
2256	Unicorn-56573.exe
848	44848eaa59859fdf1d3d91ea7bb3310f_JaffaCakes118.exe
848	44848eaa59859fdf1d3d91ea7bb3310f_JaffaCakes118.exe
2236	Unicorn-25607.exe
2236	Unicorn-25607.exe
2260	Unicorn-14746.exe
2260	Unicorn-14746.exe
2256	Unicorn-56573.exe
2256	Unicorn-56573.exe
2876	Unicorn-43574.exe
2876	Unicorn-43574.exe
2236	Unicorn-25607.exe
2236	Unicorn-25607.exe
2728	Unicorn-46075.exe
2728	Unicorn-46075.exe
2644	Unicorn-4487.exe
2644	Unicorn-4487.exe
2260	Unicorn-14746.exe
2260	Unicorn-14746.exe
2688	Unicorn-18961.exe
2688	Unicorn-18961.exe
2876	Unicorn-43574.exe
2876	Unicorn-43574.exe
1700	Unicorn-21653.exe
1700	Unicorn-21653.exe
2508	Unicorn-2624.exe
2508	Unicorn-2624.exe
2728	Unicorn-46075.exe
2728	Unicorn-46075.exe
2980	Unicorn-40127.exe
2980	Unicorn-40127.exe
2964	Unicorn-64077.exe
2964	Unicorn-64077.exe
2644	Unicorn-4487.exe
2644	Unicorn-4487.exe
536	Unicorn-42671.exe
536	Unicorn-42671.exe
588	Unicorn-14637.exe
588	Unicorn-14637.exe
2688	Unicorn-18961.exe
2688	Unicorn-18961.exe
1952	Unicorn-44617.exe
1952	Unicorn-44617.exe
1700	Unicorn-21653.exe
1700	Unicorn-21653.exe
1088	Unicorn-12499.exe
1088	Unicorn-12499.exe
1488	Unicorn-31549.exe
2544	Unicorn-20689.exe
2544	Unicorn-20689.exe
1488	Unicorn-31549.exe
916	Unicorn-32365.exe
916	Unicorn-32365.exe
2980	Unicorn-40127.exe
2980	Unicorn-40127.exe
2492	Unicorn-5722.exe
2492	Unicorn-5722.exe
2508	Unicorn-2624.exe
2508	Unicorn-2624.exe
1512	Unicorn-40616.exe
1512	Unicorn-40616.exe

Program crash 14 IoCs

pid	pid_target	Process	procid_target
2216	2992	WerFault.exe	163
2624	2644	WerFault.exe	162
2288	1780	WerFault.exe	202
484	1956	WerFault.exe	229
2912	1960	WerFault.exe	221
376	1088	WerFault.exe	266
1572	1164	WerFault.exe	268
2804	2112	WerFault.exe	349
1612	2252	WerFault.exe	325
1324	1016	WerFault.exe	317
2924	2868	WerFault.exe	369
1656	3044	WerFault.exe	398
1320	1872	WerFault.exe	372
720	2332	WerFault.exe	401

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44612.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43780.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34434.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10417.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8273.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58663.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16416.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61994.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57199.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55352.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50642.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36501.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57687.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11309.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13271.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54771.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11316.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19831.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45902.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34631.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57905.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45435.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57912.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34916.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63354.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48871.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53287.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4054.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48289.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36719.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10141.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49272.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29703.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46125.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44838.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51252.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7049.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3127.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52759.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20236.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62171.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34626.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56981.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8948.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57905.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31969.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10453.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9514.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20492.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54869.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22192.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64262.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56862.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1434.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31078.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31735.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31315.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30826.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19467.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22862.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12087.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55144.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50739.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21990.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
848	44848eaa59859fdf1d3d91ea7bb3310f_JaffaCakes118.exe
2256	Unicorn-56573.exe
2236	Unicorn-25607.exe
2260	Unicorn-14746.exe
2876	Unicorn-43574.exe
2644	Unicorn-4487.exe
2728	Unicorn-46075.exe
2688	Unicorn-18961.exe
1700	Unicorn-21653.exe
2508	Unicorn-2624.exe
2964	Unicorn-64077.exe
2980	Unicorn-40127.exe
536	Unicorn-42671.exe
588	Unicorn-14637.exe
1952	Unicorn-44617.exe
1088	Unicorn-12499.exe
2492	Unicorn-5722.exe
916	Unicorn-32365.exe
2544	Unicorn-20689.exe
1488	Unicorn-31549.exe
2076	Unicorn-18250.exe
1512	Unicorn-40616.exe
2316	Unicorn-20750.exe
1572	Unicorn-20196.exe
1548	Unicorn-15296.exe
1596	Unicorn-31078.exe
1616	Unicorn-6381.exe
1880	Unicorn-41192.exe
2292	Unicorn-59666.exe
2320	Unicorn-31632.exe
876	Unicorn-51498.exe
1272	Unicorn-23272.exe
2588	Unicorn-34669.exe
2788	Unicorn-22993.exe
1296	Unicorn-3127.exe
2192	Unicorn-49635.exe
2652	Unicorn-17517.exe
2760	Unicorn-64025.exe
2860	Unicorn-43413.exe
2540	Unicorn-27631.exe
2520	Unicorn-41275.exe
2548	Unicorn-41275.exe
2556	Unicorn-4881.exe
1632	Unicorn-11103.exe
540	Unicorn-51389.exe
2524	Unicorn-16579.exe
1460	Unicorn-27461.exe
1680	Unicorn-60880.exe
2764	Unicorn-28747.exe
1496	Unicorn-36361.exe
2276	Unicorn-11664.exe
2144	Unicorn-56781.exe
2876	Unicorn-17887.exe
1592	Unicorn-45084.exe
604	Unicorn-47030.exe
2060	Unicorn-57912.exe
1676	Unicorn-39952.exe
1092	Unicorn-30715.exe
1664	Unicorn-39952.exe
1996	Unicorn-52759.exe
2052	Unicorn-22909.exe
1560	Unicorn-32146.exe
1888	Unicorn-65333.exe
1940	Unicorn-46345.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 2256	848	44848eaa59859fdf1d3d91ea7bb3310f_JaffaCakes118.exe	28
PID 848 wrote to memory of 2256	848	44848eaa59859fdf1d3d91ea7bb3310f_JaffaCakes118.exe	28
PID 848 wrote to memory of 2256	848	44848eaa59859fdf1d3d91ea7bb3310f_JaffaCakes118.exe	28
PID 848 wrote to memory of 2256	848	44848eaa59859fdf1d3d91ea7bb3310f_JaffaCakes118.exe	28
PID 2256 wrote to memory of 2260	2256	Unicorn-56573.exe	29
PID 2256 wrote to memory of 2260	2256	Unicorn-56573.exe	29
PID 2256 wrote to memory of 2260	2256	Unicorn-56573.exe	29
PID 2256 wrote to memory of 2260	2256	Unicorn-56573.exe	29
PID 848 wrote to memory of 2236	848	44848eaa59859fdf1d3d91ea7bb3310f_JaffaCakes118.exe	30
PID 848 wrote to memory of 2236	848	44848eaa59859fdf1d3d91ea7bb3310f_JaffaCakes118.exe	30
PID 848 wrote to memory of 2236	848	44848eaa59859fdf1d3d91ea7bb3310f_JaffaCakes118.exe	30
PID 848 wrote to memory of 2236	848	44848eaa59859fdf1d3d91ea7bb3310f_JaffaCakes118.exe	30
PID 2236 wrote to memory of 2876	2236	Unicorn-25607.exe	31
PID 2236 wrote to memory of 2876	2236	Unicorn-25607.exe	31
PID 2236 wrote to memory of 2876	2236	Unicorn-25607.exe	31
PID 2236 wrote to memory of 2876	2236	Unicorn-25607.exe	31
PID 2260 wrote to memory of 2644	2260	Unicorn-14746.exe	32
PID 2260 wrote to memory of 2644	2260	Unicorn-14746.exe	32
PID 2260 wrote to memory of 2644	2260	Unicorn-14746.exe	32
PID 2260 wrote to memory of 2644	2260	Unicorn-14746.exe	32
PID 2256 wrote to memory of 2728	2256	Unicorn-56573.exe	33
PID 2256 wrote to memory of 2728	2256	Unicorn-56573.exe	33
PID 2256 wrote to memory of 2728	2256	Unicorn-56573.exe	33
PID 2256 wrote to memory of 2728	2256	Unicorn-56573.exe	33
PID 2876 wrote to memory of 2688	2876	Unicorn-43574.exe	34
PID 2876 wrote to memory of 2688	2876	Unicorn-43574.exe	34
PID 2876 wrote to memory of 2688	2876	Unicorn-43574.exe	34
PID 2876 wrote to memory of 2688	2876	Unicorn-43574.exe	34
PID 2236 wrote to memory of 1700	2236	Unicorn-25607.exe	35
PID 2236 wrote to memory of 1700	2236	Unicorn-25607.exe	35
PID 2236 wrote to memory of 1700	2236	Unicorn-25607.exe	35
PID 2236 wrote to memory of 1700	2236	Unicorn-25607.exe	35
PID 2728 wrote to memory of 2508	2728	Unicorn-46075.exe	36
PID 2728 wrote to memory of 2508	2728	Unicorn-46075.exe	36
PID 2728 wrote to memory of 2508	2728	Unicorn-46075.exe	36
PID 2728 wrote to memory of 2508	2728	Unicorn-46075.exe	36
PID 2644 wrote to memory of 2964	2644	Unicorn-4487.exe	37
PID 2644 wrote to memory of 2964	2644	Unicorn-4487.exe	37
PID 2644 wrote to memory of 2964	2644	Unicorn-4487.exe	37
PID 2644 wrote to memory of 2964	2644	Unicorn-4487.exe	37
PID 2260 wrote to memory of 2980	2260	Unicorn-14746.exe	38
PID 2260 wrote to memory of 2980	2260	Unicorn-14746.exe	38
PID 2260 wrote to memory of 2980	2260	Unicorn-14746.exe	38
PID 2260 wrote to memory of 2980	2260	Unicorn-14746.exe	38
PID 2688 wrote to memory of 536	2688	Unicorn-18961.exe	39
PID 2688 wrote to memory of 536	2688	Unicorn-18961.exe	39
PID 2688 wrote to memory of 536	2688	Unicorn-18961.exe	39
PID 2688 wrote to memory of 536	2688	Unicorn-18961.exe	39
PID 2876 wrote to memory of 588	2876	Unicorn-43574.exe	40
PID 2876 wrote to memory of 588	2876	Unicorn-43574.exe	40
PID 2876 wrote to memory of 588	2876	Unicorn-43574.exe	40
PID 2876 wrote to memory of 588	2876	Unicorn-43574.exe	40
PID 1700 wrote to memory of 1952	1700	Unicorn-21653.exe	41
PID 1700 wrote to memory of 1952	1700	Unicorn-21653.exe	41
PID 1700 wrote to memory of 1952	1700	Unicorn-21653.exe	41
PID 1700 wrote to memory of 1952	1700	Unicorn-21653.exe	41
PID 2508 wrote to memory of 2492	2508	Unicorn-2624.exe	42
PID 2508 wrote to memory of 2492	2508	Unicorn-2624.exe	42
PID 2508 wrote to memory of 2492	2508	Unicorn-2624.exe	42
PID 2508 wrote to memory of 2492	2508	Unicorn-2624.exe	42
PID 2728 wrote to memory of 1088	2728	Unicorn-46075.exe	43
PID 2728 wrote to memory of 1088	2728	Unicorn-46075.exe	43
PID 2728 wrote to memory of 1088	2728	Unicorn-46075.exe	43
PID 2728 wrote to memory of 1088	2728	Unicorn-46075.exe	43

C:\Users\Admin\AppData\Local\Temp\44848eaa59859fdf1d3d91ea7bb3310f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\44848eaa59859fdf1d3d91ea7bb3310f_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:848
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56573.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56573.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14746.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14746.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4487.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4487.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64077.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20689.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41192.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41275.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42282.exe
        9⤵
        
        PID:1156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10569.exe
        10⤵
        
        PID:1884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4054.exe
        11⤵
        
        PID:1336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50764.exe
        12⤵
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55144.exe
        13⤵
        System Location Discovery: System Language Discovery
        
        PID:1984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10515.exe
        14⤵
        
        PID:1928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18103.exe
        15⤵
        
        PID:2604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57905.exe
        16⤵
        
        PID:832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10453.exe
        17⤵
        
        PID:1352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41839.exe
        18⤵
        
        PID:1728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54771.exe
        19⤵
        System Location Discovery: System Language Discovery
        
        PID:352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61372.exe
        20⤵
        
        PID:2292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40447.exe
        17⤵
        
        PID:580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38435.exe
        18⤵
        
        PID:2920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16967.exe
        19⤵
        
        PID:332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58187.exe
        9⤵
        
        PID:2100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50733.exe
        10⤵
        
        PID:2292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37298.exe
        11⤵
        
        PID:1816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27516.exe
        12⤵
        
        PID:1728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34060.exe
        13⤵
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44361.exe
        14⤵
        
        PID:1800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56862.exe
        15⤵
        System Location Discovery: System Language Discovery
        
        PID:2504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42768.exe
        16⤵
        
        PID:1500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6836.exe
        17⤵
        
        PID:1888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33042.exe
        18⤵
        
        PID:1336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37470.exe
        19⤵
        
        PID:2680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56981.exe
        12⤵
        System Location Discovery: System Language Discovery
        
        PID:1740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34631.exe
        13⤵
        System Location Discovery: System Language Discovery
        
        PID:2500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40163.exe
        14⤵
        
        PID:1944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54392.exe
        15⤵
        
        PID:1692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37283.exe
        16⤵
        
        PID:2968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63645.exe
        17⤵
        
        PID:1740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63257.exe
        8⤵
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11036.exe
        9⤵
        
        PID:2600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7946.exe
        10⤵
        
        PID:668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57718.exe
        11⤵
        
        PID:2696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51252.exe
        12⤵
        
        PID:2016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34828.exe
        13⤵
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35207.exe
        14⤵
        
        PID:2364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10738.exe
        15⤵
        
        PID:588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31969.exe
        16⤵
        System Location Discovery: System Language Discovery
        
        PID:1008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30511.exe
        17⤵
        
        PID:2220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62171.exe
        18⤵
        System Location Discovery: System Language Discovery
        
        PID:1836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24341.exe
        19⤵
        
        PID:2788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5310.exe
        14⤵
        
        PID:1540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11164.exe
        15⤵
        
        PID:996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61429.exe
        16⤵
        
        PID:2088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14376.exe
        17⤵
        
        PID:2956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1398.exe
        18⤵
        
        PID:1096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31549.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6381.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41275.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65333.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25235.exe
        9⤵
        
        PID:2400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53063.exe
        10⤵
        
        PID:2512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4578.exe
        11⤵
        
        PID:1388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13945.exe
        12⤵
        
        PID:2964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45222.exe
        13⤵
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24823.exe
        14⤵
        
        PID:2600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52866.exe
        15⤵
        
        PID:444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64262.exe
        16⤵
        System Location Discovery: System Language Discovery
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11164.exe
        17⤵
        
        PID:2084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40241.exe
        18⤵
        
        PID:1328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36572.exe
        19⤵
        
        PID:2096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61756.exe
        20⤵
        
        PID:2028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46345.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5198.exe
        8⤵
        
        PID:1724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-79.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-79.exe
        9⤵
        
        PID:1712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11703.exe
        10⤵
        
        PID:2912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58102.exe
        11⤵
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34916.exe
        12⤵
        System Location Discovery: System Language Discovery
        
        PID:1764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21760.exe
        13⤵
        
        PID:3036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31315.exe
        14⤵
        System Location Discovery: System Language Discovery
        
        PID:2484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39047.exe
        15⤵
        
        PID:2652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8341.exe
        16⤵
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9514.exe
        17⤵
        System Location Discovery: System Language Discovery
        
        PID:2752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61185.exe
        18⤵
        
        PID:2772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16967.exe
        19⤵
        
        PID:2020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54495.exe
        8⤵
        
        PID:2628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34646.exe
        9⤵
        
        PID:2948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32346.exe
        10⤵
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26660.exe
        11⤵
        
        PID:2928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53105.exe
        12⤵
        
        PID:2376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34770.exe
        13⤵
        
        PID:2968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33671.exe
        14⤵
        
        PID:932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55757.exe
        15⤵
        
        PID:1664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15789.exe
        16⤵
        
        PID:2056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4881.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40336.exe
        7⤵
        
        PID:2272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11036.exe
        8⤵
        
        PID:2096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51501.exe
        9⤵
        
        PID:2040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15700.exe
        10⤵
        
        PID:2252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43551.exe
        11⤵
        
        PID:1800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33458.exe
        12⤵
        
        PID:2968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59820.exe
        13⤵
        
        PID:1492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48331.exe
        14⤵
        
        PID:2476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12316.exe
        15⤵
        
        PID:2132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37117.exe
        16⤵
        
        PID:2140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40848.exe
        17⤵
        
        PID:3036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53287.exe
        18⤵
        
        PID:1952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40127.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40127.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32365.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59666.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51389.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17586.exe
        8⤵
        
        PID:1808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12515.exe
        9⤵
        
        PID:1756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47334.exe
        10⤵
        
        PID:2664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50214.exe
        11⤵
        
        PID:2892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35278.exe
        12⤵
        
        PID:2220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9856.exe
        13⤵
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36722.exe
        14⤵
        
        PID:2948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25477.exe
        15⤵
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17147.exe
        16⤵
        
        PID:2060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53728.exe
        17⤵
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16692.exe
        18⤵
        
        PID:1712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5611.exe
        14⤵
        
        PID:2096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44714.exe
        15⤵
        
        PID:1624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50739.exe
        16⤵
        System Location Discovery: System Language Discovery
        
        PID:396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34434.exe
        17⤵
        
        PID:2684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16915.exe
        18⤵
        
        PID:1884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34258.exe
        8⤵
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8247.exe
        9⤵
        
        PID:2200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10141.exe
        10⤵
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35278.exe
        11⤵
        
        PID:2612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57194.exe
        12⤵
        
        PID:1388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47651.exe
        13⤵
        
        PID:2448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16126.exe
        14⤵
        
        PID:2764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20101.exe
        15⤵
        
        PID:2280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49177.exe
        16⤵
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34434.exe
        17⤵
        System Location Discovery: System Language Discovery
        
        PID:1876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41336.exe
        18⤵
        
        PID:1628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28823.exe
        14⤵
        
        PID:948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6281.exe
        15⤵
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55669.exe
        16⤵
        
        PID:2648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57672.exe
        17⤵
        
        PID:1704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42644.exe
        7⤵
        
        PID:2636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3719.exe
        8⤵
        
        PID:2320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11703.exe
        9⤵
        
        PID:2476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22773.exe
        10⤵
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40775.exe
        11⤵
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9550.exe
        12⤵
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57905.exe
        13⤵
        System Location Discovery: System Language Discovery
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22898.exe
        14⤵
        
        PID:2404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30826.exe
        14⤵
        System Location Discovery: System Language Discovery
        
        PID:1696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25716.exe
        15⤵
        
        PID:2964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30973.exe
        16⤵
        
        PID:880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11103.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30715.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54124.exe
        8⤵
        
        PID:3028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63753.exe
        9⤵
        
        PID:1836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52819.exe
        10⤵
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35928.exe
        11⤵
        
        PID:2532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35383.exe
        12⤵
        
        PID:1612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42234.exe
        7⤵
        
        PID:2232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34973.exe
        8⤵
        
        PID:2556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22176.exe
        9⤵
        
        PID:1648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59612.exe
        10⤵
        
        PID:2520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1662.exe
        11⤵
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23339.exe
        12⤵
        
        PID:2520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60365.exe
        13⤵
        
        PID:332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34979.exe
        14⤵
        
        PID:2156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65160.exe
        15⤵
        
        PID:1532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53287.exe
        16⤵
        System Location Discovery: System Language Discovery
        
        PID:2420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31632.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27461.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39952.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44996.exe
        8⤵
        
        PID:2956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39166.exe
        9⤵
        
        PID:916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62191.exe
        10⤵
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52072.exe
        11⤵
        
        PID:2332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45990.exe
        12⤵
        
        PID:1884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15175.exe
        13⤵
        
        PID:2588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41429.exe
        14⤵
        
        PID:1764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47838.exe
        15⤵
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10453.exe
        16⤵
        
        PID:2824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27003.exe
        17⤵
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7599.exe
        18⤵
        
        PID:444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34346.exe
        19⤵
        
        PID:2144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36103.exe
        9⤵
        
        PID:2004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12087.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:1588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60515.exe
        11⤵
        
        PID:2828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16271.exe
        12⤵
        
        PID:1272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2643.exe
        13⤵
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59851.exe
        14⤵
        
        PID:1748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7848.exe
        15⤵
        
        PID:3060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17958.exe
        16⤵
        
        PID:2068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
        17⤵
        System Location Discovery: System Language Discovery
        
        PID:2820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32125.exe
        18⤵
        
        PID:1772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20235.exe
        17⤵
        
        PID:2284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11316.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29703.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12798.exe
        9⤵
        
        PID:3060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47988.exe
        10⤵
        
        PID:2468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56343.exe
        11⤵
        
        PID:2876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11942.exe
        12⤵
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9031.exe
        13⤵
        
        PID:788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11849.exe
        14⤵
        
        PID:2320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45731.exe
        15⤵
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6556.exe
        16⤵
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31632.exe
        17⤵
        
        PID:2572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22909.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36719.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-333.exe
        8⤵
        
        PID:1784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9093.exe
        9⤵
        
        PID:2240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16442.exe
        10⤵
        
        PID:1336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57687.exe
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53105.exe
        12⤵
        
        PID:1736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13115.exe
        13⤵
        
        PID:264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18456.exe
        14⤵
        
        PID:1992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48217.exe
        15⤵
        
        PID:2832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19660.exe
        16⤵
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46515.exe
        17⤵
        
        PID:2148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46075.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46075.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2624.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2624.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5722.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51498.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57912.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37657.exe
        8⤵
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14277.exe
        9⤵
        
        PID:960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15019.exe
        10⤵
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3255.exe
        11⤵
        
        PID:1656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1688.exe
        12⤵
        
        PID:2272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55928.exe
        13⤵
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33017.exe
        14⤵
        
        PID:2032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57132.exe
        15⤵
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8227.exe
        16⤵
        
        PID:1748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30973.exe
        17⤵
        
        PID:1000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10417.exe
        18⤵
        System Location Discovery: System Language Discovery
        
        PID:2220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60880.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40336.exe
        7⤵
        
        PID:720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47025.exe
        8⤵
        
        PID:2448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42230.exe
        9⤵
        
        PID:948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51776.exe
        10⤵
        
        PID:2784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57199.exe
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11309.exe
        12⤵
        System Location Discovery: System Language Discovery
        
        PID:1744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47760.exe
        13⤵
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26027.exe
        14⤵
        
        PID:1836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23199.exe
        15⤵
        
        PID:2600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22810.exe
        16⤵
        
        PID:760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19467.exe
        17⤵
        System Location Discovery: System Language Discovery
        
        PID:1160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21705.exe
        7⤵
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27381.exe
        8⤵
        
        PID:840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4578.exe
        9⤵
        
        PID:1560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31735.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:1692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8932.exe
        11⤵
        
        PID:2280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-951.exe
        12⤵
        
        PID:2132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52010.exe
        13⤵
        
        PID:1496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57350.exe
        14⤵
        
        PID:1548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59675.exe
        15⤵
        
        PID:1036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57532.exe
        16⤵
        
        PID:2244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37335.exe
        17⤵
        
        PID:1208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23272.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16579.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45790.exe
        7⤵
        
        PID:2880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63854.exe
        8⤵
        
        PID:264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57256.exe
        9⤵
        
        PID:1612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47609.exe
        10⤵
        
        PID:1288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42150.exe
        11⤵
        
        PID:2580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17293.exe
        12⤵
        
        PID:1496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36774.exe
        13⤵
        
        PID:1624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32061.exe
        14⤵
        
        PID:2712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22566.exe
        15⤵
        
        PID:2148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20485.exe
        16⤵
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48684.exe
        17⤵
        
        PID:1760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18446.exe
        18⤵
        
        PID:2520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15875.exe
        9⤵
        
        PID:3000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64900.exe
        10⤵
        
        PID:1956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54350.exe
        11⤵
        
        PID:1164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27681.exe
        12⤵
        
        PID:2252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-204.exe
        13⤵
        
        PID:2868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48777.exe
        14⤵
        
        PID:2332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20485.exe
        15⤵
        
        PID:2364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29032.exe
        16⤵
        
        PID:2416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33220.exe
        17⤵
        
        PID:2888
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2332 -s 212
        15⤵
        Program crash
        
        PID:720
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 232
        14⤵
        Program crash
        
        PID:2924
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2252 -s 232
        13⤵
        Program crash
        
        PID:1612
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1164 -s 232
        12⤵
        Program crash
        
        PID:1572
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1956 -s 232
        11⤵
        Program crash
        
        PID:484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23568.exe
        7⤵
        
        PID:1032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11036.exe
        8⤵
        
        PID:2304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1999.exe
        9⤵
        
        PID:2432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42726.exe
        10⤵
        
        PID:2808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9856.exe
        11⤵
        
        PID:2540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62404.exe
        12⤵
        
        PID:2824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48289.exe
        13⤵
        System Location Discovery: System Language Discovery
        
        PID:1840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34107.exe
        14⤵
        
        PID:2756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58175.exe
        15⤵
        
        PID:2944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17906.exe
        16⤵
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40677.exe
        17⤵
        
        PID:2584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12499.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12499.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31078.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28747.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49272.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4054.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4578.exe
        9⤵
        
        PID:1624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46125.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28502.exe
        11⤵
        
        PID:1324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26660.exe
        12⤵
        
        PID:1092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16027.exe
        13⤵
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10510.exe
        14⤵
        
        PID:1156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59851.exe
        15⤵
        
        PID:2844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29229.exe
        16⤵
        
        PID:1712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57345.exe
        17⤵
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14724.exe
        18⤵
        
        PID:1944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12607.exe
        19⤵
        
        PID:1272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14666.exe
        10⤵
        
        PID:848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14407.exe
        11⤵
        
        PID:3000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43484.exe
        12⤵
        
        PID:1536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59851.exe
        13⤵
        
        PID:2952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33204.exe
        14⤵
        
        PID:1096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3349.exe
        15⤵
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63645.exe
        16⤵
        
        PID:2524
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25607.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25607.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43574.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43574.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18961.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18961.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42671.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18250.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49635.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45790.exe
        8⤵
        
        PID:1744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39350.exe
        9⤵
        
        PID:2868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36584.exe
        10⤵
        
        PID:2804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20967.exe
        11⤵
        
        PID:2276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50318.exe
        12⤵
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62949.exe
        13⤵
        
        PID:1748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19151.exe
        14⤵
        
        PID:760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6810.exe
        15⤵
        
        PID:2716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29919.exe
        16⤵
        
        PID:3008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45435.exe
        17⤵
        System Location Discovery: System Language Discovery
        
        PID:1772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20480.exe
        18⤵
        
        PID:1396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45664.exe
        19⤵
        
        PID:2948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1948.exe
        20⤵
        
        PID:1616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48740.exe
        10⤵
        
        PID:316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47412.exe
        11⤵
        
        PID:1724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62518.exe
        12⤵
        
        PID:1036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22192.exe
        13⤵
        System Location Discovery: System Language Discovery
        
        PID:2528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62046.exe
        14⤵
        
        PID:1008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28601.exe
        15⤵
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31590.exe
        16⤵
        
        PID:1964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38383.exe
        17⤵
        
        PID:980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59675.exe
        18⤵
        
        PID:1616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20236.exe
        19⤵
        System Location Discovery: System Language Discovery
        
        PID:2756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22862.exe
        20⤵
        System Location Discovery: System Language Discovery
        
        PID:2688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32144.exe
        15⤵
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22566.exe
        16⤵
        
        PID:1672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33204.exe
        17⤵
        
        PID:2524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19302.exe
        18⤵
        
        PID:2144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34626.exe
        19⤵
        System Location Discovery: System Language Discovery
        
        PID:964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34346.exe
        20⤵
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62108.exe
        13⤵
        
        PID:2236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20625.exe
        14⤵
        
        PID:352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57905.exe
        15⤵
        
        PID:2696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62622.exe
        16⤵
        
        PID:2880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34543.exe
        17⤵
        
        PID:2080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32509.exe
        18⤵
        
        PID:1504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56241.exe
        8⤵
        
        PID:2288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36584.exe
        9⤵
        
        PID:2516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42513.exe
        10⤵
        
        PID:1680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44838.exe
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:2796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58948.exe
        12⤵
        
        PID:2004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34823.exe
        13⤵
        
        PID:1188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3385.exe
        14⤵
        
        PID:1680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34107.exe
        15⤵
        
        PID:1000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12612.exe
        16⤵
        
        PID:588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53448.exe
        17⤵
        
        PID:2296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60879.exe
        18⤵
        
        PID:2828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63449.exe
        7⤵
        
        PID:1700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22137.exe
        8⤵
        
        PID:848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16416.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23271.exe
        10⤵
        
        PID:1632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4853.exe
        11⤵
        
        PID:1512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48367.exe
        12⤵
        
        PID:1548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50837.exe
        13⤵
        
        PID:1628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19338.exe
        14⤵
        
        PID:2984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63634.exe
        15⤵
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61429.exe
        16⤵
        
        PID:924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21990.exe
        17⤵
        System Location Discovery: System Language Discovery
        
        PID:2844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14008.exe
        18⤵
        
        PID:844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17517.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36361.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20492.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49726.exe
        9⤵
        
        PID:2260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54526.exe
        10⤵
        
        PID:3008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22197.exe
        11⤵
        
        PID:872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63141.exe
        12⤵
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52098.exe
        13⤵
        
        PID:2068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51351.exe
        14⤵
        
        PID:1676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57905.exe
        15⤵
        
        PID:1988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22898.exe
        16⤵
        
        PID:2352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27470.exe
        17⤵
        
        PID:2688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45664.exe
        18⤵
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14501.exe
        19⤵
        
        PID:2500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45551.exe
        7⤵
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36501.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48185.exe
        9⤵
        
        PID:444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41766.exe
        10⤵
        
        PID:2132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58289.exe
        11⤵
        
        PID:1072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56483.exe
        12⤵
        
        PID:2900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51351.exe
        13⤵
        
        PID:2416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53292.exe
        14⤵
        
        PID:1160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63354.exe
        15⤵
        System Location Discovery: System Language Discovery
        
        PID:2328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30843.exe
        16⤵
        
        PID:1784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41336.exe
        17⤵
        
        PID:2576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20750.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22993.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39952.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52863.exe
        8⤵
        
        PID:2708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23297.exe
        9⤵
        
        PID:1500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32207.exe
        10⤵
        
        PID:2940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54869.exe
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:2688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9856.exe
        12⤵
        
        PID:2088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56483.exe
        13⤵
        
        PID:2724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63904.exe
        14⤵
        
        PID:2112
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 200
        15⤵
        Program crash
        
        PID:2804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52759.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62458.exe
        7⤵
        
        PID:2952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42238.exe
        8⤵
        
        PID:2944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29213.exe
        9⤵
        
        PID:1736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39083.exe
        10⤵
        
        PID:2092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34911.exe
        11⤵
        
        PID:948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18103.exe
        12⤵
        
        PID:2572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53292.exe
        13⤵
        
        PID:2068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41372.exe
        14⤵
        
        PID:2256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58990.exe
        15⤵
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55586.exe
        16⤵
        
        PID:2996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14637.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14637.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40616.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34669.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51965.exe
        7⤵
        
        PID:396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16683.exe
        8⤵
        
        PID:2812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62985.exe
        9⤵
        
        PID:2644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4578.exe
        10⤵
        
        PID:1988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58678.exe
        11⤵
        
        PID:964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61833.exe
        12⤵
        
        PID:2284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44039.exe
        13⤵
        
        PID:2244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19831.exe
        14⤵
        System Location Discovery: System Language Discovery
        
        PID:1704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29364.exe
        15⤵
        
        PID:2164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33827.exe
        16⤵
        
        PID:2028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3323.exe
        17⤵
        
        PID:2696
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 368
        10⤵
        Program crash
        
        PID:2624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32146.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14736.exe
        7⤵
        
        PID:580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20967.exe
        8⤵
        
        PID:1840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61994.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:1604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51252.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:1836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20822.exe
        11⤵
        
        PID:1348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37537.exe
        12⤵
        
        PID:3032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28596.exe
        13⤵
        
        PID:2508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46743.exe
        14⤵
        
        PID:880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16697.exe
        15⤵
        
        PID:2128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65352.exe
        16⤵
        
        PID:1356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12446.exe
        17⤵
        
        PID:2088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3127.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23232.exe
        6⤵
        Executes dropped EXE
        
        PID:2240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16299.exe
        7⤵
        
        PID:1328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39441.exe
        8⤵
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24615.exe
        9⤵
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16058.exe
        10⤵
        
        PID:2836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48943.exe
        11⤵
        
        PID:112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36722.exe
        12⤵
        
        PID:1712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30604.exe
        13⤵
        
        PID:1888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1434.exe
        14⤵
        System Location Discovery: System Language Discovery
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56385.exe
        15⤵
        
        PID:1348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13271.exe
        16⤵
        System Location Discovery: System Language Discovery
        
        PID:1604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25519.exe
        17⤵
        
        PID:2320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21653.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21653.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44617.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44617.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20196.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64025.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11664.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44612.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45930.exe
        9⤵
        
        PID:484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38599.exe
        10⤵
        
        PID:2448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23567.exe
        11⤵
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9856.exe
        12⤵
        
        PID:2500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31106.exe
        12⤵
        
        PID:2320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24626.exe
        13⤵
        
        PID:888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3852.exe
        14⤵
        
        PID:2688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45072.exe
        15⤵
        
        PID:2808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7049.exe
        16⤵
        System Location Discovery: System Language Discovery
        
        PID:2404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64413.exe
        17⤵
        
        PID:2536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8218.exe
        7⤵
        
        PID:2552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56537.exe
        8⤵
        
        PID:1396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22180.exe
        9⤵
        
        PID:2984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-769.exe
        10⤵
        
        PID:1712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11070.exe
        11⤵
        
        PID:1532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32638.exe
        12⤵
        
        PID:1288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7469.exe
        13⤵
        
        PID:2836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45700.exe
        14⤵
        
        PID:2576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2285.exe
        15⤵
        
        PID:1984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39011.exe
        16⤵
        
        PID:1188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34346.exe
        17⤵
        
        PID:1460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45084.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61908.exe
        7⤵
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25235.exe
        8⤵
        
        PID:1536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24584.exe
        9⤵
        
        PID:928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1013.exe
        10⤵
        
        PID:1748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38533.exe
        11⤵
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35575.exe
        12⤵
        
        PID:2716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8761.exe
        13⤵
        
        PID:2888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8948.exe
        14⤵
        System Location Discovery: System Language Discovery
        
        PID:960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33256.exe
        15⤵
        
        PID:2552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10453.exe
        16⤵
        System Location Discovery: System Language Discovery
        
        PID:1676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25716.exe
        17⤵
        
        PID:1072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56245.exe
        18⤵
        
        PID:2352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38041.exe
        7⤵
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62985.exe
        8⤵
        
        PID:2992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5372.exe
        9⤵
        
        PID:1780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4433.exe
        10⤵
        
        PID:1960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8273.exe
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:1088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45902.exe
        12⤵
        System Location Discovery: System Language Discovery
        
        PID:1016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11641.exe
        13⤵
        
        PID:1872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11849.exe
        14⤵
        
        PID:2232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34548.exe
        15⤵
        
        PID:1808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52441.exe
        16⤵
        
        PID:1828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16967.exe
        17⤵
        
        PID:888
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1872 -s 372
        14⤵
        Program crash
        
        PID:1320
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1016 -s 372
        13⤵
        Program crash
        
        PID:1324
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 376
        12⤵
        Program crash
        
        PID:376
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1960 -s 364
        11⤵
        Program crash
        
        PID:2912
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1780 -s 372
        10⤵
        Program crash
        
        PID:2288
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2992 -s 376
        9⤵
        Program crash
        
        PID:2216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27631.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17887.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50642.exe
        7⤵
        
        PID:2580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13558.exe
        8⤵
        
        PID:2188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31657.exe
        9⤵
        
        PID:2528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48818.exe
        10⤵
        
        PID:2124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48367.exe
        11⤵
        
        PID:1992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56483.exe
        12⤵
        
        PID:2360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21803.exe
        13⤵
        
        PID:1320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57905.exe
        14⤵
        
        PID:1272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16017.exe
        15⤵
        
        PID:2716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58990.exe
        16⤵
        
        PID:2448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43780.exe
        17⤵
        System Location Discovery: System Language Discovery
        
        PID:1008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15296.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15296.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43413.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56781.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50642.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1581.exe
        8⤵
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36291.exe
        9⤵
        
        PID:2608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3997.exe
        10⤵
        
        PID:1344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20822.exe
        11⤵
        
        PID:2164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55352.exe
        12⤵
        System Location Discovery: System Language Discovery
        
        PID:580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57905.exe
        13⤵
        System Location Discovery: System Language Discovery
        
        PID:2820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24050.exe
        14⤵
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58663.exe
        15⤵
        System Location Discovery: System Language Discovery
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34263.exe
        16⤵
        
        PID:2640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64217.exe
        6⤵
        
        PID:1160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64705.exe
        7⤵
        
        PID:1928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62191.exe
        8⤵
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14739.exe
        9⤵
        
        PID:2068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13701.exe
        10⤵
        
        PID:332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49877.exe
        11⤵
        
        PID:1096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-287.exe
        12⤵
        
        PID:1032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5243.exe
        13⤵
        
        PID:2420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9986.exe
        14⤵
        
        PID:648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21720.exe
        15⤵
        
        PID:2612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15300.exe
        16⤵
        
        PID:872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7490.exe
        17⤵
        
        PID:2612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8595.exe
        13⤵
        
        PID:2580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13598.exe
        14⤵
        
        PID:2900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55793.exe
        15⤵
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42898.exe
        16⤵
        
        PID:1684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47030.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44996.exe
        6⤵
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36584.exe
        7⤵
        
        PID:2504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10141.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55144.exe
        9⤵
        
        PID:1620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36582.exe
        10⤵
        
        PID:2336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44937.exe
        11⤵
        
        PID:2016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3276.exe
        12⤵
        
        PID:3044
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 236
        13⤵
        Program crash
        
        PID:1656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-14736.exe

Filesize
188KB

MD5
285c0a37f94c283a9b1dcf1e5f174035

SHA1
a6316abb206b2f42b6ffdc75d495a6114e96ccd8

SHA256
c36e71e4f6c80ffb95722327cd2b60312570374bfdc2e869ba5f707f8e8265d9

SHA512
e1b4939795d5e68ac52d6b6c09b286abbada4946965b5ba5e5e14f01aa0e81f05a16a6a759d8c77bbbd3d93678ca446d15edf31d8fc345c218c1d36660d1a2de

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40447.exe

Filesize
188KB

MD5
d7243709115fed7ad641c410f7129ebd

SHA1
fc1f416141d88d26d48fdde859005471309c634a

SHA256
ae8b7280a515c8c804bb0fbea5971fea157c2ba90d654a5a8f2578b0e9eb3a1b

SHA512
20a22a81d3771770346f7bf8ed6a4f42094938765135b518823308e31a93b15e9113da626114c1c2b337ebc540fdae018e5935c42080d2c1e510ff5559bc81c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40775.exe

Filesize
188KB

MD5
8700c9de4464ee8934b7721bcb07e327

SHA1
37c9db30d057660b9d04f47da25ce2ae8408db76

SHA256
02f79e5b68442a2689e992dc429a56b2d233c4a03d65dac85ba35a2d5fec031b

SHA512
2400815c666ed26d8d0f07b409f9584ab8f9b2a8e09657fa48ee20976966f077872fb83e28b65b8dfc6c6402d4bd16c43309030dfbfc99b9d4c7a986e48a07c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41192.exe

Filesize
188KB

MD5
4823d660137b0e5445ebfcd23769ecd2

SHA1
f3e95b9ee1451c11e03ede6d77d99ab1cd1c74d1

SHA256
1ca60c84c6d610cd43dfb08a3c3e2d89f80caa48773406df09a915a56444190f

SHA512
3f152678cb3126e1d1eb51036cb259ef8de1547869b93628a867ba2bd7ae80d488da6f9d0e58c4b7f9470e2740501baf3570a6b3ec7b35c68ddb267983524191

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41429.exe

Filesize
188KB

MD5
3d8c993ecc74a524773b9dfa2cc88a1c

SHA1
933e053bd1eba2588883834c309b0d33bfa02def

SHA256
417180d1b2ed04b4cc6075eac2ed6fa22129eaf2655911df68d314d84abc951a

SHA512
fb3b250a9fa72b38cea4e13515a39a9629f574adcd89541bac0725bde2898dd36f0acfe218af5cdf0a591b8af01018926b8ff7471949c1995a6631660de0d264

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44617.exe

Filesize
188KB

MD5
ad402d34391b4b31b2ed033fc5510b96

SHA1
50c51f30ac2f81d1fed6059e11833c4f1d0ae987

SHA256
40c553badb62c496d5826103899069c150c71499727cd137cacb8cc0a0ad4d39

SHA512
1388b0a896bbf9989445cae8673728c090873b60bc98bf60e710cc11637edd5c4b9cd52b62fa9407a8d23b6112d538e39f1167cb3cde81a101caf383275a6187

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44937.exe

Filesize
188KB

MD5
6d540b60fa2dbb99614723d34d0fe822

SHA1
0963785321c438f8be6928f08a62b3be2cca35de

SHA256
83f50ad81e8a0ac8f6dedd3e57f337b3f005756d7295cb7af212abaae26ef97d

SHA512
c77fdc2d3a36bdbc6ab1c5059eb85b0d7b82b515ffa79d4612ca20f205554f695f5a03e0c98e976b75d951b7ab289a025ddedbb53d922d2b58468f78e3da2872

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5722.exe

Filesize
188KB

MD5
c5ed26b63e729ab2b021c1906c582aef

SHA1
5207311a139625afa53b4ff4fc195417a5b37cac

SHA256
f278b49d69deac2bdbec5e00c2a54f441c230a2001520fb7b3a331669d3c0c61

SHA512
590cf637662dae2148edcaab1bb5d3fd478f925482adbfd6e91d71b1889affea31b8ccccbcdac2a02a754ad2f4b1a89d3526bac7654832b1500df52b6a47bf49

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6281.exe

Filesize
188KB

MD5
e65786d86b3c59511a558d32047231c4

SHA1
92a8e255f4e29f659992389307191fff03120028

SHA256
5b233bb6ed8418ee6793989227983263f85c8d8b4169d7dac8c98d90742f530d

SHA512
37496f30f1c3a4bad46e4e1c8b6206e816bdb9dd118bea36ebc01b47adb26a95785e8d3230a80890620d2498ac1473170e6fe4c6dfb663c831bf2c8edb2de5df

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64077.exe

Filesize
188KB

MD5
c55b13333ecab4dfa30f9f83ab338e8f

SHA1
393ec3aa1165d8a7e196856c11c15f95d60446bb

SHA256
6e6e458c516ff51a3b19ae7532ed911494453a95e34791f4f1610456f7024525

SHA512
87c2db443af1a609a7968262fc3d2da728d159c0eaadef5fd1470d467a5d6a4293bbd4a78f09826ab32d92e37d68702ec159b96aa676a2a6bd9f819dab7c2b6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6556.exe

Filesize
188KB

MD5
95e63b943acc9bbf25c9832e43966047

SHA1
ab66efa732829bec32ea8ae91b473279442a05d3

SHA256
e708a6ea24bda187d42a709ccb2577d525d0353cb3f51b079991985c9c04ae0f

SHA512
6a68266f26121e97c3f38343b3536b8d40ca41d47e0729e10224a2e32d74df5774b0ed400f26ef30c9d2e0bb9edfcc7ba213285dcc96b051c0f8ab4d95061204

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-12499.exe

Filesize
188KB

MD5
85f18a060fdb17f3edf27c14f2f8e117

SHA1
b4aebc4ea1746e40075e1dd3cb826db410d42805

SHA256
f409c8323de5f47502c17f53f34e7a14dd4af5be28d9c0bd5262d98955da2b01

SHA512
daac420bdb8d7c0534448edd4e7212c3518a15fd6e66d4132af6f2f84cc3ac3565c573dc08648d247acc8136ab9a22d8c7497ad4452a28865da1ae29eac8198b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-14637.exe

Filesize
188KB

MD5
cdce79e094345c0adb49dbfb4e365f9a

SHA1
8987ae8896d7432aee82ecea5bf8d4335704334c

SHA256
c1cf70b6607672a5391826cf38a9d16e99fba6a509989407c1b34ecc1c6d12fe

SHA512
1dd008f7a1da25696f43107cb5ac19b21ee5b74b57541c0b9d0ee5b08dd4d00a07a82ad297c1025f75258a408d9fd67f0e271026aba55800f93ce69a11e0d83f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-14746.exe

Filesize
188KB

MD5
e47d29dd3286f032620d926426844b63

SHA1
91897f538c382e52ac6f1db00642e6839b35c72b

SHA256
90d04e5f6284aa98a306823ca2754f281ef62bdc69f53c1d432093b058e2c259

SHA512
b3a2c1ff2416d713d571895d2c22a58a50fdb33737dfad01c4e59bb2b0dc7c02af318a742ef9d3d243ea81c1689b6a3f54fd20c51376b3d8b53f05f0cbdc0c4a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-18961.exe

Filesize
188KB

MD5
3fa3661e49f2ef9a03c6158110f1ad2e

SHA1
bb25f46d49ece275562573d460ec824ffd1c2b69

SHA256
bdaf82fa5cdad3a48a970d9d09f415c8baf8ee3fa22c6787ea9451970ac2beae

SHA512
b7cc74dcb6694fef0e8d8ee82d0d3c3e60149c66a896a692ae65d1823c96ce6faa268516cd87edb50eb76163170f8305481d3e0b3d3ace68bb5f1a1b9e043cb1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-20689.exe

Filesize
188KB

MD5
65485396e1cc2f03f28985388784a702

SHA1
e948248d72a9b7ab8c75d599243b8a2c94273f30

SHA256
3c9b194171b2fd0dbe0cd0bb89be797e489b844fcf4409e6f8cf516ec6e947ee

SHA512
ca81cea9ef97ffc6d18d6cee1d57f53d319ef5bf6040fde6a137fb5617b6ef45a603372dfe0a0ddac6d5b4709e7da936ec29ba89cb5e45f70a2101c64830fec7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-21653.exe

Filesize
188KB

MD5
7b71cdec580deb026182be6edf2fe88e

SHA1
bf5e09e6fb7e9d05698b4beb4b1c7deedcd418ce

SHA256
dd841140276d0d502aeb58f6ecc37fd96f6461cab432e7d562ea97a1f7bf3394

SHA512
36ba579e68d1df859b74fbe15da006203ce7a7df7a8a4f066293cbd89a80792ad6030b61acbc27f7b296ba261a6cb79bdd288effa281fc9e1fb98568b67c27f7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-25607.exe

Filesize
188KB

MD5
9b5686f35f31578cd8998c7611fdd604

SHA1
76b2476ae070a477ab87c1481a8bc1f78f614027

SHA256
2b721305982f45c02abff8a412bb35e4b7f2cef3d069913cb26f42f9e2810baf

SHA512
662e12a22d7320afbe5694af7b9d09a3f265a1a2e51f7ebfe9ab12856c9a93ed5e07231d60c19c9f55ae99898809d41019f67fbb8c58aa6b770c8b45033f2fe0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-2624.exe

Filesize
188KB

MD5
fffc6cd014bcd4b739dada679270186c

SHA1
f696c818ae40efa45bd25553579fef9d32c2f18a

SHA256
00f7af301a16a60970b3f60e2cdd20a205376900c2a3b4923e3a9c79ab5ec6f7

SHA512
c3486d7b52c64101fc3694360450ac0ebb6710bf2a9baa82e74e01bc821528a017785b594a2583a23a23e0bec7c32f296166cdc299c408ebea4fe260c091e6f9

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-32365.exe

Filesize
188KB

MD5
118ea11e6ae5a9c329d0a39d5db35771

SHA1
e7fe6ae8d9914007eac090ab3953f2647560490f

SHA256
de71da4dfdf239deb81163e5268dae6cc76c724624c051ec477614ed3ecfe915

SHA512
e8a43951b6c7ba43c86c0771d68bfa200e1b725b082d8ec3c31675644879c29f778f7c993e302bd61d32e702acd1c16b0807a1b1fbe0f1d4c3985abeab203afe

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-40127.exe

Filesize
188KB

MD5
3680717b4f01dc000d0ab9aa616a429e

SHA1
0a0e309df1587e31bbf6fa035286a9f511ec8883

SHA256
b25bb6fca1f19a58fed2c3b4d621cc2a9985934f5f0f8187d83ee00bab03f947

SHA512
6a6c6f0212c61864b18a7046552278d9d8bbe0541e3394e09cb7b4a0af1699737cd73f9d8664c21fc60c086a358c8ae2da1f457d58269e97782fd9c913ba4f4b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-42671.exe

Filesize
188KB

MD5
7bb26c31d6a8545ef1c54d75cf6f8f84

SHA1
b5d8f4b274f55f0d77acf7672b3e50d0babd5c38

SHA256
054706dd75c0107c14f4b4bf1327f9d051324b42ae78edb2329274e3996af8b1

SHA512
83e09760c58e42f43b3b875b53f077867a868a30429a76be20692ee78b1278cbff2b89839372d734506f41819b892349049781c26158ff021aa6cb9b21e6ee3a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-43574.exe

Filesize
188KB

MD5
e31781ff8202b42e705900dab0645b74

SHA1
139188cd9b947cf4aa7a985483459b81fdcd00ec

SHA256
5b03ddb4d5535ef43f51a4e677c4f72d4f43ed7bcc8caf3726001a0800fb2e2b

SHA512
54cc49bdb977f643b3ee3dccc8da34053e70ee6ec6e1e0ab7c7b15e055353c1122ded240611f7cb279733682fbcf12ca3bf6abc16ce12638fcc65aa60da96fb7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-4487.exe

Filesize
188KB

MD5
07adb4ef2522974b89508de14d7a2c6e

SHA1
9ac877bbdbb79cbb31dcb1f50e6b5b44b74faf88

SHA256
6a48c263cc97c4a89dbbc8b58c72a904c2afd2b951d6b819cd1413faeb4b4a11

SHA512
b39113c5a9b78eb19f0d7f48e510edf5d8b77fab2e2564499743f4b0c47302fe005995363a1080bc677e75b26735ecd529727239031e2cf00b9bb43dd7471442

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-46075.exe

Filesize
188KB

MD5
53775e77c932a7a74ad41a45b3d05fbe

SHA1
f963bc18f516a6b645815283b0c98dc8c664c18e

SHA256
07adaf5d76ae2506520e503b973b5cd1405bb44aacd8ab1325251a974fa140af

SHA512
a72277fc40769e28f6dd9842a2e9d2943390a7b85f0264b36d175a76f28689728aed900fb414c25f87b64c96959e91b1fd8d6b5928d84a5ac903452b9435ee95

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-56573.exe

Filesize
188KB

MD5
215b090ed9bd8e7832cf8cccf9289358

SHA1
61aad44174d1d710d444f8bf17d005b76523e2a7

SHA256
33ed58007ed4cce13d7028ebfcd392cf4512fde567af1065bf7c0bef35e10219

SHA512
c27b80bb67b382a94f197cd349f0a954a4f908ea7424e5dc61988e90ee8b651e264ac5fe764fb17aa3ed7dea94a71517c1f9bf921a8b06d366528053f1503379

Download Submit
memory/1944-3487-0x00000000027F0000-0x000000000294C000-memory.dmp

Filesize
1.4MB

Download