b6a1eecbf9c6064decfbc331ce1836645310ddca09461f438fa2a2a27c0a5d86

Analysis

max time kernel
116s
max time network
20s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
25/07/2024, 23:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2fc619b81c12994be3ad5e0cfa98a700N.exe
Size

468KB
MD5

2fc619b81c12994be3ad5e0cfa98a700
SHA1

30071829d53851979e2e8616405807cfcc17219a
SHA256

b6a1eecbf9c6064decfbc331ce1836645310ddca09461f438fa2a2a27c0a5d86
SHA512

98f176a497f7b7df67b6b6d1b41d3cb6411f29dfa8f2c0bb67b46addace7157250d48f9458b8b1d4892a0d46620a3a9fd584b5ce2c102c8300681b9e9a45c1b2
SSDEEP

3072:ibAhogICId5UtbYTPztjcf8cDCMvPgpwamHeGfqJreV8cM3Nkrlz:ibOobbUtkPJjcfjcPBreKF3Nk

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2780	Unicorn-65346.exe
2728	Unicorn-35544.exe
2704	Unicorn-23846.exe
2700	Unicorn-52155.exe
2636	Unicorn-29597.exe
2156	Unicorn-9731.exe
332	Unicorn-50109.exe
1256	Unicorn-3613.exe
2168	Unicorn-34894.exe
2260	Unicorn-54760.exe
2868	Unicorn-48730.exe
1988	Unicorn-28864.exe
1968	Unicorn-48730.exe
2920	Unicorn-50768.exe
2572	Unicorn-48465.exe
2008	Unicorn-21102.exe
1124	Unicorn-38184.exe
2276	Unicorn-19156.exe
1644	Unicorn-60472.exe
632	Unicorn-1065.exe
3024	Unicorn-303.exe
1616	Unicorn-39960.exe
2216	Unicorn-5704.exe
2112	Unicorn-25570.exe
1520	Unicorn-58526.exe
1544	Unicorn-64656.exe
1712	Unicorn-42098.exe
2688	Unicorn-18148.exe
3040	Unicorn-50266.exe
2984	Unicorn-5953.exe
988	Unicorn-46545.exe
1816	Unicorn-64355.exe
1368	Unicorn-56550.exe
2744	Unicorn-17101.exe
2828	Unicorn-21185.exe
2892	Unicorn-15054.exe
1964	Unicorn-18195.exe
2720	Unicorn-11418.exe
2632	Unicorn-1039.exe
2596	Unicorn-41953.exe
344	Unicorn-23479.exe
2708	Unicorn-11973.exe
2644	Unicorn-28309.exe
536	Unicorn-60162.exe
2964	Unicorn-3634.exe
1436	Unicorn-65087.exe
1940	Unicorn-38999.exe
2120	Unicorn-61095.exe
1824	Unicorn-6949.exe
2764	Unicorn-13940.exe
1660	Unicorn-38253.exe
1916	Unicorn-18387.exe
1996	Unicorn-11610.exe
2568	Unicorn-21816.exe
2432	Unicorn-8081.exe
2228	Unicorn-7618.exe
1068	Unicorn-44475.exe
1404	Unicorn-30085.exe
804	Unicorn-56541.exe
1048	Unicorn-35299.exe
1224	Unicorn-26577.exe
2056	Unicorn-21786.exe
1744	Unicorn-41652.exe
636	Unicorn-43882.exe

Loads dropped DLL 64 IoCs

pid	Process
2232	2fc619b81c12994be3ad5e0cfa98a700N.exe
2232	2fc619b81c12994be3ad5e0cfa98a700N.exe
2780	Unicorn-65346.exe
2780	Unicorn-65346.exe
2232	2fc619b81c12994be3ad5e0cfa98a700N.exe
2232	2fc619b81c12994be3ad5e0cfa98a700N.exe
2728	Unicorn-35544.exe
2728	Unicorn-35544.exe
2704	Unicorn-23846.exe
2704	Unicorn-23846.exe
2780	Unicorn-65346.exe
2780	Unicorn-65346.exe
2232	2fc619b81c12994be3ad5e0cfa98a700N.exe
2232	2fc619b81c12994be3ad5e0cfa98a700N.exe
2636	Unicorn-29597.exe
2636	Unicorn-29597.exe
2704	Unicorn-23846.exe
2700	Unicorn-52155.exe
2704	Unicorn-23846.exe
2700	Unicorn-52155.exe
2156	Unicorn-9731.exe
332	Unicorn-50109.exe
2728	Unicorn-35544.exe
2156	Unicorn-9731.exe
332	Unicorn-50109.exe
2728	Unicorn-35544.exe
2232	2fc619b81c12994be3ad5e0cfa98a700N.exe
2780	Unicorn-65346.exe
2780	Unicorn-65346.exe
2232	2fc619b81c12994be3ad5e0cfa98a700N.exe
1256	Unicorn-3613.exe
1256	Unicorn-3613.exe
2636	Unicorn-29597.exe
2636	Unicorn-29597.exe
2168	Unicorn-34894.exe
2168	Unicorn-34894.exe
2704	Unicorn-23846.exe
2704	Unicorn-23846.exe
2572	Unicorn-48465.exe
2572	Unicorn-48465.exe
2232	2fc619b81c12994be3ad5e0cfa98a700N.exe
2232	2fc619b81c12994be3ad5e0cfa98a700N.exe
1968	Unicorn-48730.exe
1968	Unicorn-48730.exe
2156	Unicorn-9731.exe
1988	Unicorn-28864.exe
2156	Unicorn-9731.exe
1988	Unicorn-28864.exe
2728	Unicorn-35544.exe
2728	Unicorn-35544.exe
2868	Unicorn-48730.exe
2868	Unicorn-48730.exe
2920	Unicorn-50768.exe
2920	Unicorn-50768.exe
332	Unicorn-50109.exe
332	Unicorn-50109.exe
2260	Unicorn-54760.exe
2260	Unicorn-54760.exe
2780	Unicorn-65346.exe
2780	Unicorn-65346.exe
2700	Unicorn-52155.exe
2700	Unicorn-52155.exe
2008	Unicorn-21102.exe
2008	Unicorn-21102.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2656	1928	WerFault.exe	134

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2155.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35150.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21697.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30952.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38184.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18148.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3634.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12806.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44178.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37952.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22893.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58895.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54760.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61657.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17101.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50999.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43306.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64536.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1286.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-204.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43026.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22286.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6218.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48201.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1443.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59664.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19041.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25693.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25835.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35299.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11428.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43183.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1060.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19156.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7536.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36582.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32440.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64760.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4599.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3287.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19041.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24776.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27729.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2233.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64222.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22816.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22522.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40063.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38418.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10846.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61244.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21185.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60162.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61850.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14978.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44392.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2fc619b81c12994be3ad5e0cfa98a700N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50109.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58526.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19082.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5751.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3613.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50768.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2232	2fc619b81c12994be3ad5e0cfa98a700N.exe
2780	Unicorn-65346.exe
2728	Unicorn-35544.exe
2704	Unicorn-23846.exe
2700	Unicorn-52155.exe
2636	Unicorn-29597.exe
332	Unicorn-50109.exe
2156	Unicorn-9731.exe
1256	Unicorn-3613.exe
2168	Unicorn-34894.exe
1988	Unicorn-28864.exe
2572	Unicorn-48465.exe
2920	Unicorn-50768.exe
2260	Unicorn-54760.exe
2868	Unicorn-48730.exe
1968	Unicorn-48730.exe
2008	Unicorn-21102.exe
1124	Unicorn-38184.exe
2276	Unicorn-19156.exe
1644	Unicorn-60472.exe
632	Unicorn-1065.exe
3024	Unicorn-303.exe
1616	Unicorn-39960.exe
2216	Unicorn-5704.exe
2112	Unicorn-25570.exe
1520	Unicorn-58526.exe
1544	Unicorn-64656.exe
1712	Unicorn-42098.exe
2688	Unicorn-18148.exe
3040	Unicorn-50266.exe
2984	Unicorn-5953.exe
988	Unicorn-46545.exe
1816	Unicorn-64355.exe
1368	Unicorn-56550.exe
2744	Unicorn-17101.exe
2828	Unicorn-21185.exe
2892	Unicorn-15054.exe
1964	Unicorn-18195.exe
2720	Unicorn-11418.exe
2632	Unicorn-1039.exe
2596	Unicorn-41953.exe
344	Unicorn-23479.exe
2644	Unicorn-28309.exe
2964	Unicorn-3634.exe
1436	Unicorn-65087.exe
536	Unicorn-60162.exe
2708	Unicorn-11973.exe
1940	Unicorn-38999.exe
2120	Unicorn-61095.exe
1824	Unicorn-6949.exe
2764	Unicorn-13940.exe
1916	Unicorn-18387.exe
1660	Unicorn-38253.exe
1996	Unicorn-11610.exe
2432	Unicorn-8081.exe
2228	Unicorn-7618.exe
2568	Unicorn-21816.exe
1068	Unicorn-44475.exe
1404	Unicorn-30085.exe
804	Unicorn-56541.exe
1048	Unicorn-35299.exe
1224	Unicorn-26577.exe
1744	Unicorn-41652.exe
2056	Unicorn-21786.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2780	2232	2fc619b81c12994be3ad5e0cfa98a700N.exe	30
PID 2232 wrote to memory of 2780	2232	2fc619b81c12994be3ad5e0cfa98a700N.exe	30
PID 2232 wrote to memory of 2780	2232	2fc619b81c12994be3ad5e0cfa98a700N.exe	30
PID 2232 wrote to memory of 2780	2232	2fc619b81c12994be3ad5e0cfa98a700N.exe	30
PID 2780 wrote to memory of 2728	2780	Unicorn-65346.exe	31
PID 2780 wrote to memory of 2728	2780	Unicorn-65346.exe	31
PID 2780 wrote to memory of 2728	2780	Unicorn-65346.exe	31
PID 2780 wrote to memory of 2728	2780	Unicorn-65346.exe	31
PID 2232 wrote to memory of 2704	2232	2fc619b81c12994be3ad5e0cfa98a700N.exe	32
PID 2232 wrote to memory of 2704	2232	2fc619b81c12994be3ad5e0cfa98a700N.exe	32
PID 2232 wrote to memory of 2704	2232	2fc619b81c12994be3ad5e0cfa98a700N.exe	32
PID 2232 wrote to memory of 2704	2232	2fc619b81c12994be3ad5e0cfa98a700N.exe	32
PID 2728 wrote to memory of 2700	2728	Unicorn-35544.exe	33
PID 2728 wrote to memory of 2700	2728	Unicorn-35544.exe	33
PID 2728 wrote to memory of 2700	2728	Unicorn-35544.exe	33
PID 2728 wrote to memory of 2700	2728	Unicorn-35544.exe	33
PID 2704 wrote to memory of 2636	2704	Unicorn-23846.exe	34
PID 2704 wrote to memory of 2636	2704	Unicorn-23846.exe	34
PID 2704 wrote to memory of 2636	2704	Unicorn-23846.exe	34
PID 2704 wrote to memory of 2636	2704	Unicorn-23846.exe	34
PID 2780 wrote to memory of 2156	2780	Unicorn-65346.exe	35
PID 2780 wrote to memory of 2156	2780	Unicorn-65346.exe	35
PID 2780 wrote to memory of 2156	2780	Unicorn-65346.exe	35
PID 2780 wrote to memory of 2156	2780	Unicorn-65346.exe	35
PID 2232 wrote to memory of 332	2232	2fc619b81c12994be3ad5e0cfa98a700N.exe	36
PID 2232 wrote to memory of 332	2232	2fc619b81c12994be3ad5e0cfa98a700N.exe	36
PID 2232 wrote to memory of 332	2232	2fc619b81c12994be3ad5e0cfa98a700N.exe	36
PID 2232 wrote to memory of 332	2232	2fc619b81c12994be3ad5e0cfa98a700N.exe	36
PID 2636 wrote to memory of 1256	2636	Unicorn-29597.exe	37
PID 2636 wrote to memory of 1256	2636	Unicorn-29597.exe	37
PID 2636 wrote to memory of 1256	2636	Unicorn-29597.exe	37
PID 2636 wrote to memory of 1256	2636	Unicorn-29597.exe	37
PID 2704 wrote to memory of 2168	2704	Unicorn-23846.exe	38
PID 2704 wrote to memory of 2168	2704	Unicorn-23846.exe	38
PID 2704 wrote to memory of 2168	2704	Unicorn-23846.exe	38
PID 2704 wrote to memory of 2168	2704	Unicorn-23846.exe	38
PID 2700 wrote to memory of 2260	2700	Unicorn-52155.exe	39
PID 2700 wrote to memory of 2260	2700	Unicorn-52155.exe	39
PID 2700 wrote to memory of 2260	2700	Unicorn-52155.exe	39
PID 2700 wrote to memory of 2260	2700	Unicorn-52155.exe	39
PID 2156 wrote to memory of 1968	2156	Unicorn-9731.exe	41
PID 2156 wrote to memory of 1968	2156	Unicorn-9731.exe	41
PID 2156 wrote to memory of 1968	2156	Unicorn-9731.exe	41
PID 2156 wrote to memory of 1968	2156	Unicorn-9731.exe	41
PID 332 wrote to memory of 2868	332	Unicorn-50109.exe	42
PID 332 wrote to memory of 2868	332	Unicorn-50109.exe	42
PID 332 wrote to memory of 2868	332	Unicorn-50109.exe	42
PID 332 wrote to memory of 2868	332	Unicorn-50109.exe	42
PID 2728 wrote to memory of 1988	2728	Unicorn-35544.exe	40
PID 2728 wrote to memory of 1988	2728	Unicorn-35544.exe	40
PID 2728 wrote to memory of 1988	2728	Unicorn-35544.exe	40
PID 2728 wrote to memory of 1988	2728	Unicorn-35544.exe	40
PID 2232 wrote to memory of 2572	2232	2fc619b81c12994be3ad5e0cfa98a700N.exe	43
PID 2232 wrote to memory of 2572	2232	2fc619b81c12994be3ad5e0cfa98a700N.exe	43
PID 2232 wrote to memory of 2572	2232	2fc619b81c12994be3ad5e0cfa98a700N.exe	43
PID 2232 wrote to memory of 2572	2232	2fc619b81c12994be3ad5e0cfa98a700N.exe	43
PID 2780 wrote to memory of 2920	2780	Unicorn-65346.exe	44
PID 2780 wrote to memory of 2920	2780	Unicorn-65346.exe	44
PID 2780 wrote to memory of 2920	2780	Unicorn-65346.exe	44
PID 2780 wrote to memory of 2920	2780	Unicorn-65346.exe	44
PID 1256 wrote to memory of 2008	1256	Unicorn-3613.exe	45
PID 1256 wrote to memory of 2008	1256	Unicorn-3613.exe	45
PID 1256 wrote to memory of 2008	1256	Unicorn-3613.exe	45
PID 1256 wrote to memory of 2008	1256	Unicorn-3613.exe	45

C:\Users\Admin\AppData\Local\Temp\2fc619b81c12994be3ad5e0cfa98a700N.exe
"C:\Users\Admin\AppData\Local\Temp\2fc619b81c12994be3ad5e0cfa98a700N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Users\Admin\AppData\Local\Temp\Unicorn-65346.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-65346.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35544.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35544.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52155.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52155.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54760.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50266.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38253.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62238.exe
        8⤵
        
        PID:1508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-842.exe
        8⤵
        
        PID:1836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1060.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49061.exe
        8⤵
        
        PID:4456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21664.exe
        8⤵
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15730.exe
        7⤵
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63203.exe
        7⤵
        
        PID:3480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8046.exe
        7⤵
        
        PID:3208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19082.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1286.exe
        7⤵
        
        PID:5504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8081.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43602.exe
        7⤵
        
        PID:3420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59664.exe
        7⤵
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39672.exe
        7⤵
        
        PID:4388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57042.exe
        6⤵
        
        PID:1640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22711.exe
        7⤵
        
        PID:2060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40063.exe
        7⤵
        
        PID:3724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8725.exe
        7⤵
        
        PID:4432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21134.exe
        7⤵
        
        PID:6056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24776.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50999.exe
        6⤵
        
        PID:3692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2362.exe
        6⤵
        
        PID:4200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1286.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46545.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6218.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48964.exe
        7⤵
        
        PID:3540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24682.exe
        7⤵
        
        PID:4848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30952.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32776.exe
        6⤵
        
        PID:2800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27729.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45400.exe
        6⤵
        
        PID:4684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33450.exe
        6⤵
        
        PID:5024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21816.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19520.exe
        6⤵
        
        PID:4732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62362.exe
        6⤵
        
        PID:4508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62907.exe
        5⤵
        
        PID:2128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16110.exe
        5⤵
        
        PID:3944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34463.exe
        5⤵
        
        PID:3108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19427.exe
        5⤵
        
        PID:1920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39713.exe
        5⤵
        
        PID:5756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28864.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28864.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25570.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65087.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62238.exe
        7⤵
        
        PID:1672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24776.exe
        7⤵
        
        PID:3872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50999.exe
        7⤵
        
        PID:3760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2362.exe
        7⤵
        
        PID:2508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61244.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42372.exe
        6⤵
        
        PID:2036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61034.exe
        7⤵
        
        PID:572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5175.exe
        7⤵
        
        PID:4008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53799.exe
        7⤵
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27563.exe
        7⤵
        
        PID:4212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5751.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22278.exe
        6⤵
        
        PID:2016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19722.exe
        6⤵
        
        PID:4048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19191.exe
        6⤵
        
        PID:5064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64752.exe
        6⤵
        
        PID:5244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38999.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62238.exe
        6⤵
        
        PID:1072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-842.exe
        6⤵
        
        PID:1732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58895.exe
        6⤵
        
        PID:3440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44392.exe
        6⤵
        
        PID:5076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64222.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40841.exe
        5⤵
        
        PID:1488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54538.exe
        5⤵
        
        PID:3448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57048.exe
        5⤵
        
        PID:3248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36148.exe
        5⤵
        
        PID:4908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44596.exe
        5⤵
        
        PID:4316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60335.exe
        5⤵
        
        PID:6104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58526.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23479.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12928.exe
        6⤵
        
        PID:576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43602.exe
        6⤵
        
        PID:3488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10846.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44283.exe
        6⤵
        
        PID:4824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60714.exe
        6⤵
        
        PID:5696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7453.exe
        5⤵
        
        PID:1928
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 188
        6⤵
        Program crash
        
        PID:2656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1723.exe
        5⤵
        
        PID:3588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22248.exe
        5⤵
        
        PID:1880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39672.exe
        5⤵
        
        PID:5116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60162.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60162.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38995.exe
        5⤵
        
        PID:2624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42182.exe
        6⤵
        
        PID:5336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35652.exe
        5⤵
        
        PID:2772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58895.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55082.exe
        5⤵
        
        PID:4284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60714.exe
        5⤵
        
        PID:5732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30064.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30064.exe
      4⤵
      PID:1716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44989.exe
        5⤵
        
        PID:4068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2425.exe
        5⤵
        
        PID:4176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63514.exe
        5⤵
        
        PID:5788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60779.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60779.exe
      4⤵
      PID:316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56625.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56625.exe
      4⤵
      PID:3700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33200.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33200.exe
      4⤵
      PID:4932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62775.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62775.exe
      4⤵
      PID:4536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9731.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9731.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48730.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48730.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39960.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5834.exe
        6⤵
        
        PID:2992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35596.exe
        7⤵
        
        PID:1728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57338.exe
        7⤵
        
        PID:3428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16711.exe
        7⤵
        
        PID:3240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49978.exe
        7⤵
        
        PID:936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32864.exe
        6⤵
        
        PID:1168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20442.exe
        6⤵
        
        PID:2448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56095.exe
        6⤵
        
        PID:3192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19191.exe
        6⤵
        
        PID:5080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64752.exe
        6⤵
        
        PID:5232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28309.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36582.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19041.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64650.exe
        6⤵
        
        PID:3784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35226.exe
        6⤵
        
        PID:4420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61244.exe
        6⤵
        
        PID:5676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51256.exe
        5⤵
        
        PID:1444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8123.exe
        6⤵
        
        PID:3184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24682.exe
        6⤵
        
        PID:4868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30952.exe
        6⤵
        
        PID:5648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5585.exe
        5⤵
        
        PID:348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19063.exe
        5⤵
        
        PID:3560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41052.exe
        5⤵
        
        PID:4792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32915.exe
        5⤵
        
        PID:4568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5704.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5704.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29465.exe
        5⤵
        
        PID:1736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-204.exe
        6⤵
        
        PID:696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59664.exe
        6⤵
        
        PID:3412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18897.exe
        6⤵
        
        PID:4300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22816.exe
        6⤵
        
        PID:5632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65112.exe
        5⤵
        
        PID:3904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51529.exe
        5⤵
        
        PID:3116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63434.exe
        5⤵
        
        PID:2308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34378.exe
        5⤵
        
        PID:5616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61095.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61095.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48201.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46997.exe
        5⤵
        
        PID:3396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8725.exe
        5⤵
        
        PID:4380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21134.exe
        5⤵
        
        PID:6068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34319.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34319.exe
      4⤵
      PID:1692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16110.exe
      4⤵
      PID:3960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34463.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34463.exe
      4⤵
      PID:3144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19427.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19427.exe
      4⤵
      PID:4184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61488.exe
      4⤵
      PID:5560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50768.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50768.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42098.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42098.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30085.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-204.exe
        6⤵
        
        PID:2356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32440.exe
        6⤵
        
        PID:3984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40665.exe
        6⤵
        
        PID:2900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3842.exe
        6⤵
        
        PID:5780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43306.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18910.exe
        5⤵
        
        PID:3912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59664.exe
        5⤵
        
        PID:2968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54062.exe
        5⤵
        
        PID:920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35299.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35299.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2155.exe
        5⤵
        
        PID:2400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41035.exe
        6⤵
        
        PID:4580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31101.exe
        5⤵
        
        PID:2924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46176.exe
        5⤵
        
        PID:3888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35150.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47878.exe
        5⤵
        
        PID:2132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38812.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38812.exe
      4⤵
      PID:1780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65476.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65476.exe
      4⤵
      PID:2664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61850.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61850.exe
      4⤵
      PID:3652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28864.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28864.exe
      4⤵
      PID:4660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-590.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-590.exe
      4⤵
      PID:4112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-134.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-134.exe
      4⤵
      PID:5052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5953.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5953.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44475.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44475.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-204.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22522.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44392.exe
        5⤵
        
        PID:5092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64222.exe
        5⤵
        
        PID:5312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43306.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43306.exe
      4⤵
      PID:996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18910.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18910.exe
      4⤵
      PID:3928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59664.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59664.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18897.exe
      4⤵
      PID:4312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22816.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22816.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56541.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56541.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2155.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2155.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31101.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31101.exe
      4⤵
      PID:884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64650.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64650.exe
      4⤵
      PID:2604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54065.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54065.exe
      4⤵
      PID:4704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43026.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43026.exe
      4⤵
      PID:4268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29782.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29782.exe
    3⤵
    PID:1952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25757.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25757.exe
      4⤵
      PID:2912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53525.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53525.exe
      4⤵
      PID:3604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59664.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59664.exe
      4⤵
      PID:3136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18897.exe
      4⤵
      PID:4224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44178.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44178.exe
      4⤵
      PID:5684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22893.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22893.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60646.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60646.exe
    3⤵
    PID:3968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24663.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24663.exe
    3⤵
    PID:3100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62299.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62299.exe
    3⤵
    PID:4156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10842.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10842.exe
    3⤵
    PID:5720
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23846.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23846.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29597.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29597.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3613.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3613.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21102.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64355.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26577.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35596.exe
        8⤵
        
        PID:1676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57338.exe
        8⤵
        
        PID:3472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16711.exe
        8⤵
        
        PID:3200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35617.exe
        8⤵
        
        PID:4920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22816.exe
        8⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15542.exe
        7⤵
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7588.exe
        7⤵
        
        PID:3548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57932.exe
        7⤵
        
        PID:3768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19082.exe
        7⤵
        
        PID:4964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61244.exe
        7⤵
        
        PID:5764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21786.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43183.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32440.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5221.exe
        7⤵
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8725.exe
        7⤵
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21134.exe
        7⤵
        
        PID:6096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28116.exe
        6⤵
        
        PID:2492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31237.exe
        6⤵
        
        PID:3212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38301.exe
        6⤵
        
        PID:4404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60092.exe
        6⤵
        
        PID:4488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56550.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41652.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28409.exe
        7⤵
        
        PID:2956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37100.exe
        7⤵
        
        PID:4088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64318.exe
        7⤵
        
        PID:4828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35939.exe
        7⤵
        
        PID:5008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14381.exe
        6⤵
        
        PID:1148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25371.exe
        6⤵
        
        PID:3224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2918.exe
        6⤵
        
        PID:4340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43026.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43882.exe
        5⤵
        Executes dropped EXE
        
        PID:636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25835.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46997.exe
        6⤵
        
        PID:4040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8725.exe
        6⤵
        
        PID:4396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21134.exe
        6⤵
        
        PID:6120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33982.exe
        5⤵
        
        PID:1664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22571.exe
        5⤵
        
        PID:3228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21765.exe
        5⤵
        
        PID:4412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-590.exe
        5⤵
        
        PID:4100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-134.exe
        5⤵
        
        PID:5136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38184.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38184.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17101.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-811.exe
        6⤵
        
        PID:2380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60453.exe
        7⤵
        
        PID:3836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40063.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21697.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3842.exe
        7⤵
        
        PID:5584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30717.exe
        6⤵
        
        PID:2988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1443.exe
        6⤵
        
        PID:3468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46966.exe
        6⤵
        
        PID:4368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60.exe
        6⤵
        
        PID:4448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10372.exe
        6⤵
        
        PID:5824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49005.exe
        5⤵
        
        PID:1524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3287.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30638.exe
        5⤵
        
        PID:1812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34463.exe
        5⤵
        
        PID:3084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19427.exe
        5⤵
        
        PID:2520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39713.exe
        5⤵
        
        PID:5592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15054.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15054.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23754.exe
        5⤵
        
        PID:2792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41481.exe
        6⤵
        
        PID:3132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24682.exe
        6⤵
        
        PID:4852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63514.exe
        6⤵
        
        PID:5608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19041.exe
        5⤵
        
        PID:736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46176.exe
        5⤵
        
        PID:4024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11086.exe
        5⤵
        
        PID:4716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43026.exe
        5⤵
        
        PID:4524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7536.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7536.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22789.exe
        5⤵
        
        PID:4228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54662.exe
        5⤵
        
        PID:4128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23934.exe
        5⤵
        
        PID:6040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29976.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29976.exe
      4⤵
      PID:2236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26840.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26840.exe
      4⤵
      PID:3736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60320.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60320.exe
      4⤵
      PID:4348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36495.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36495.exe
      4⤵
      PID:4444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34894.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34894.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19156.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19156.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21185.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37952.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19041.exe
        6⤵
        
        PID:2292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64650.exe
        6⤵
        
        PID:3728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45897.exe
        6⤵
        
        PID:4540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4599.exe
        6⤵
        
        PID:6112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10494.exe
        5⤵
        
        PID:2584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61657.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22522.exe
        6⤵
        
        PID:4084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44392.exe
        6⤵
        
        PID:5000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64222.exe
        6⤵
        
        PID:5304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32776.exe
        5⤵
        
        PID:2064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52041.exe
        5⤵
        
        PID:3812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2421.exe
        5⤵
        
        PID:4600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60092.exe
        5⤵
        
        PID:4512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18195.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18195.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42228.exe
        5⤵
        
        PID:1504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33925.exe
        6⤵
        
        PID:2564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59254.exe
        6⤵
        
        PID:3712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60732.exe
        6⤵
        
        PID:3824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44283.exe
        6⤵
        
        PID:4804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60714.exe
        6⤵
        
        PID:5704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11428.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18910.exe
        5⤵
        
        PID:3920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59664.exe
        5⤵
        
        PID:3256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49978.exe
        5⤵
        
        PID:4552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64878.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64878.exe
      4⤵
      PID:2500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57054.exe
        5⤵
        
        PID:3512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46997.exe
        5⤵
        
        PID:3820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38418.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22286.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38642.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38642.exe
      4⤵
      PID:2600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61850.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61850.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51423.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51423.exe
      4⤵
      PID:4676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11919.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11919.exe
      4⤵
      PID:4980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60472.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60472.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11418.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11418.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36198.exe
        5⤵
        
        PID:2316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20708.exe
        6⤵
        
        PID:3156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45160.exe
        6⤵
        
        PID:3400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38527.exe
        6⤵
        
        PID:5028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7350.exe
        6⤵
        
        PID:5220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19041.exe
        5⤵
        
        PID:580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1443.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4424.exe
        5⤵
        
        PID:4856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64407.exe
        5⤵
        
        PID:2188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40644.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40644.exe
      4⤵
      PID:2784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34299.exe
        5⤵
        
        PID:3264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44640.exe
        5⤵
        
        PID:4480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3842.exe
        5⤵
        
        PID:5796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32776.exe
      4⤵
      PID:1612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34463.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34463.exe
      4⤵
      PID:3828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19427.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19427.exe
      4⤵
      PID:4168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39713.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39713.exe
      4⤵
      PID:5600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1039.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1039.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36582.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36582.exe
      4⤵
      PID:1656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61849.exe
        5⤵
        
        PID:1984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53245.exe
        5⤵
        
        PID:3444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62590.exe
        5⤵
        
        PID:4320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8725.exe
        5⤵
        
        PID:4692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21134.exe
        5⤵
        
        PID:6032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19041.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19041.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46176.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46176.exe
      4⤵
      PID:3852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35150.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35150.exe
      4⤵
      PID:4876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57801.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57801.exe
      4⤵
      PID:4556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23375.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23375.exe
    3⤵
    PID:1956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46266.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46266.exe
      4⤵
      PID:5272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25693.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25693.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19593.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19593.exe
    3⤵
    PID:3596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38789.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38789.exe
    3⤵
    PID:4360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39261.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39261.exe
    3⤵
    PID:4384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64536.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64536.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4500
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50109.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50109.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48730.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48730.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64656.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64656.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13940.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58704.exe
        6⤵
        
        PID:1092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5175.exe
        6⤵
        
        PID:3996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40059.exe
        6⤵
        
        PID:4260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60.exe
        6⤵
        
        PID:4328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4599.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20364.exe
        5⤵
        
        PID:300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18910.exe
        5⤵
        
        PID:3936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59664.exe
        5⤵
        
        PID:3844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35588.exe
        5⤵
        
        PID:4476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18387.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18387.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2233.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45160.exe
        5⤵
        
        PID:3544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57001.exe
        5⤵
        
        PID:4944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32239.exe
        5⤵
        
        PID:4576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28453.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28453.exe
      4⤵
      PID:1608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24776.exe
      4⤵
      PID:3864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50999.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50999.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2362.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2362.exe
      4⤵
      PID:2148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61244.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61244.exe
      4⤵
      PID:5664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18148.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18148.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11610.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11610.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14978.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59664.exe
        5⤵
        
        PID:3408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42728.exe
        5⤵
        
        PID:5888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-328.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-328.exe
      4⤵
      PID:2124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18910.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18910.exe
      4⤵
      PID:3952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59664.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59664.exe
      4⤵
      PID:3272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18897.exe
      4⤵
      PID:4276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44178.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44178.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7618.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7618.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2980.exe
      4⤵
      PID:3172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58895.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58895.exe
      4⤵
      PID:3648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44392.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44392.exe
      4⤵
      PID:5012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5751.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5751.exe
      4⤵
      PID:5568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62907.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62907.exe
    3⤵
    PID:1876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16110.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16110.exe
    3⤵
    PID:3880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34463.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34463.exe
    3⤵
    PID:4080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12806.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12806.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5048
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48465.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48465.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1065.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1065.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41953.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38995.exe
        5⤵
        
        PID:2836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-842.exe
        5⤵
        
        PID:2244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58895.exe
        5⤵
        
        PID:3532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62866.exe
        5⤵
        
        PID:4952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62468.exe
        5⤵
        
        PID:5140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19129.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19129.exe
      4⤵
      PID:2480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51211.exe
        5⤵
        
        PID:3112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22653.exe
        5⤵
        
        PID:4248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63514.exe
        5⤵
        
        PID:5740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14577.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14577.exe
      4⤵
      PID:2884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64760.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64760.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35726.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35726.exe
      4⤵
      PID:5036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47686.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47686.exe
      4⤵
      PID:5256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11973.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11973.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38995.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38995.exe
      4⤵
      PID:2832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-842.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-842.exe
      4⤵
      PID:2412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58895.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58895.exe
      4⤵
      PID:3576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44392.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44392.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51970.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51970.exe
      4⤵
      PID:5204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21407.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21407.exe
    3⤵
    PID:1884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16328.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16328.exe
    3⤵
    PID:3524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41396.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41396.exe
    3⤵
    PID:3684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36148.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36148.exe
    3⤵
    PID:4896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51764.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51764.exe
    3⤵
    PID:6020
- C:\Users\Admin\AppData\Local\Temp\Unicorn-303.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-303.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3634.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3634.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1771.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1771.exe
      4⤵
      PID:2976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20708.exe
        5⤵
        
        PID:3148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45160.exe
        5⤵
        
        PID:3584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38527.exe
        5⤵
        
        PID:5056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42737.exe
        5⤵
        
        PID:5460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63203.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63203.exe
      4⤵
      PID:3460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8046.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8046.exe
      4⤵
      PID:2936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18141.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18141.exe
      4⤵
      PID:4144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21184.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21184.exe
    3⤵
    PID:2660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36669.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36669.exe
    3⤵
    PID:1476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4978.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4978.exe
    3⤵
    PID:3744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2421.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2421.exe
    3⤵
    PID:4640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60092.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60092.exe
    3⤵
    PID:4108
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6949.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6949.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44942.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44942.exe
    3⤵
    PID:2444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45876.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45876.exe
    3⤵
    PID:888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21863.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21863.exe
    3⤵
    PID:3568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2918.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2918.exe
    3⤵
    PID:4332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43026.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43026.exe
    3⤵
    PID:4460
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53838.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53838.exe
  2⤵
  PID:2256
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56313.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56313.exe
  2⤵
  PID:1056
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29759.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29759.exe
  2⤵
  PID:3672
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17675.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17675.exe
  2⤵
  PID:4972
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47407.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47407.exe
  2⤵
  PID:4472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-22248.exe

Filesize
468KB

MD5
8584883be06462c22e1cef2d4bd8422e

SHA1
88cbba1a40014c7332ca25d20529c849af92e8da

SHA256
2d1bf3792af69bc692109f23f7e70c810e94a9f33174463ad8ba4d7085910856

SHA512
dbec65114c41f0b9e492633fb1e0e6bdd3943bcf8ffee1916e7ad9cc335462a8e81dc11c38a7c9019902ed0763a25be69cd84ac3f124bd5d371e9e912a50cfd0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22653.exe

Filesize
468KB

MD5
2876e6c1300badbdfe25a21f75efb274

SHA1
a0aa619509c3b30b497aa015bc72a31f54ef2dce

SHA256
9f62b11ef9b01bf0c75cc537f999fe6d2c3d632dfc35243e0b049f16602ff3c3

SHA512
a885909b9ab34a6c9818a3786b29c29173c2591d4c856be466fdf9d4bfc8581e0aafa847c0cc1e94043a7b485b032c20b59a8f05e7741d9b1fa75f97895ba4a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33450.exe

Filesize
468KB

MD5
6d966f7f2e24ec56675cf3fc9baa1e98

SHA1
272685179d8aa2f20d5aa1c463e61909fe9468a7

SHA256
5cd66c888daf6272ee51096097908a4a82845fb4239bbc31c305c94bd7c5cebd

SHA512
52c8189732bfa8a606febb8685293abefa2979d094b1ae17635f62517e8aebd90c3efe0f320363961f6d1b3a8832b9cc8541cdbef37b4d9d0fbc489a3b5a7420

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48730.exe

Filesize
468KB

MD5
ef39e2b81294f3b8550b691a57cb4c67

SHA1
720a0a1b475fadcdc88e2f9240f1479c1e09e46a

SHA256
6a78194c7585533d92709cccc7a7f7a5e59bb488d49de3c10c0a0004d8c97de8

SHA512
fd726b81447c9df086a31537917050941d25404962a9507862fa54c968eb328b5ed684b52c28d06e594b3d092623f6a7b7d62b67ed844cfd5170edf52623e4fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9731.exe

Filesize
468KB

MD5
efa8fb302c8e3e99d305b1c46ea62697

SHA1
01078cb0e26543d5b269c980e2b56675eeeefd3d

SHA256
39b4a6dcbb41fa721a4c11584b6f09c9ad8e335aec0bbaf3aeb5989613006ea5

SHA512
b063262fb20a671e57bb3bb566348dac073d15766feee71097e9031f271a209a977da6a5114ed13c70a4f00023e327d3a6b888a37c69e6da0f4e48f4ba689242

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-19156.exe

Filesize
468KB

MD5
876d4b2af7e3dd90a71b9e75030205db

SHA1
9edaa58ab92c34a0df3e3f00b386b79765a97552

SHA256
7c91e680e9ad2e7391e9e3a4601e6d93034c20bb2b9e2cf5bbf41bc59266536c

SHA512
2f56a4b7a6a25fd6d4ec058c75b98e7e519837ec96d7dbc3e9c00256e1c6eccc04a400b16a6899e9f4e491ba377a212c6ffb55b23e4b9d601fb1a7f3ec9bc214

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-21102.exe

Filesize
468KB

MD5
c621009133482c8ed5bc400ee2a3f20b

SHA1
4a309bd9e7c07f135c32489e2d8a9262c47d69f6

SHA256
9a3bcfe83568e30dd4e8771f2e04b7aabfa5af6996ac06eb9842df7f386caba3

SHA512
bb8b274bf9b3edc54f3843131d0bad9a81e7f0f66935f9560863620a3034d17dd2a1214b65452ca1eb42e24939061188dfa83f5e03d44edf22689fb8e55230cb

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-23846.exe

Filesize
468KB

MD5
ab7d50cae524462fa56b43c51f11ab4c

SHA1
4925a9f45218a15a8c62b9a55c60536fc45dc2c0

SHA256
6f22c114c5d74dd07b08199660b828a4162a761c9fbb892ff60367de068f3cc2

SHA512
5f1ffc2cb23e545ab85ab757533d6e61eb2812bf87c28ce84ff1b28f0c632b337b4c00922d8b3bed931303ec747e0558926fcea13baed0203588e567c212e55f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-28864.exe

Filesize
468KB

MD5
b3113042ae578d34a39f3c9ea3ff3e94

SHA1
fce40247b0f220f1130af55befde9c5985dbd2c6

SHA256
81ec6f0b30b10b0948dae020fa4c6f7055d3790d18996079cc8bbc67e59a0b45

SHA512
392482ae789b4074ffefaab67f5346b7eaf81ff30183753c67b07226ada9de6f585752c8b5c648740c17b03a7d51ce2a1b9ea0eae2d16aa4e96108fccb1bc2d5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-29597.exe

Filesize
468KB

MD5
7517849d33321887722a1cb90e1374d0

SHA1
00d276a7d6a14e98908371983952a29833409a46

SHA256
0933c2df96ba478eaa88c55d2a7764de4277774ce2af052d99a29a739d26292a

SHA512
2d4dbecad9301da2dc4229063cfa01df45b24f6bea5eb1cf0653948e7a1b42c71c5a166dbcf4a8f1bf72dc9f9f7eda353b2f93507a341b93afedbf636e55c104

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-34894.exe

Filesize
468KB

MD5
ae90c905c62e30dfe47db6855e74a172

SHA1
c55a69e642323378ffaf41b338e49d604586f8d9

SHA256
0c76fb67c9f1c7d3aba7822404dcc64fdc7a327e53be3a96b68e7289c61394ac

SHA512
741da77c5ac17bef6645337e2a72b1fb5b5b52cedc7bd59f27cc8c48ae2957a0cf0a694b8c3b4e326f7c749526fe929dc8eecf79d11d327d15bc43fb423fc0e6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-35544.exe

Filesize
468KB

MD5
9d0180c8fbdc5d7be4ec51734ee7832d

SHA1
b689374c822edc24dbbfb4e0e08ec95c0383d3e9

SHA256
10daf2d63b351f88499a1fc7f813015b98ed602d53552d2623db885f1ce7a69c

SHA512
36c46f83ec453e5f011bc9fa3c8e45eff96afd699607caa255feb5dc857eb2b1e40e15089bd136c13d7bb7ca18f1273ba3cd9910bcf42cfbda9042b68eec2cb4

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-3613.exe

Filesize
468KB

MD5
cd6d15572132c3f0ebecbba81722ab42

SHA1
75fb605c913454d791224f16d12cb957551a9b3a

SHA256
9539efec6b5afd74b0ab755b85b30d823c587e4171e59fc2a3e6318d5f08a46e

SHA512
a524d3ed50fdb18eb5a9f5031640c4a59b6dd60b2d9f5bdc06e0033989a2b48660b0c8eb2fb304ac147595eca21634eebafb9227431d839c3aabce1242d8cdbf

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-38184.exe

Filesize
468KB

MD5
57da82c8ccba10796bdfd01393c1eda1

SHA1
cfc1ba1bdd30406b0130270489b6400fb4003288

SHA256
720b36367aa0def84cad99824661416f00ab93f9c75054cdbc17f2a087425edc

SHA512
defa94ea1dac9fb7b48ab00540ff0426eeaaab7d846a172f093ce95e35a32aff34daf2cd59cc25b74bf1fd0e8428c43688f3fa80b693646900b343f803de5698

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-48465.exe

Filesize
468KB

MD5
4b31e5391449fba3c6caaf20bf66ea0b

SHA1
722442b909c0dea0e664c2188f82ea9dd16b5b67

SHA256
7b72cf2f0c5f06c0af57c6c2e3e216d63985f3b345bd1a63d00316c825284d74

SHA512
aa6640c372b653e548b4da480fd08194c0a834fefc7f9cd3332c282f9d9e44b61e3d72a951620999aeede0b4ed83883e8684bcec5dd2a7ff353112cf643c8950

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-50109.exe

Filesize
468KB

MD5
37372ff4e4f3e40e794a40112011c734

SHA1
5ba22881767c3c60f3ac3027308ae8de3f236e84

SHA256
4e2e1240ddddc1efbc49cbac1ee7236eee9e3f048be9a7705cb0c9667ecf3ed0

SHA512
309cdf5dc6982a89aca1a24e4114dce8d16ad15883b8af304d692857b74f2d62b1eab94c5f9959642c8574793208792026fd5bd57aa4b1365f624f33eb751f25

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-50768.exe

Filesize
468KB

MD5
143949e92ccb35119d8acc9687c53d3e

SHA1
00e7dfa09ef29dd022fe1641f27fcb641ff31364

SHA256
f7d1deefa46303f6473069f5d425fefd72b6facd8f7285cec35f31e8340eda7f

SHA512
1829b0de85db4da66b46d4353f55c9b64650dc161ac5ce75e57ba426cd32db08a8b356fa01f00b9babf41f79d16342c77271f085b0834aa5ff149ba36dfb0898

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-52155.exe

Filesize
468KB

MD5
4b9a7925b9e93ce5306a0a83a136273c

SHA1
5294382f6c14ff4657b5ba4069dfbadfc46c2866

SHA256
38c49a711f6706b9f12c925d297248341c0e04690ee6565ad84567bcaeb6f949

SHA512
aa20754d5e443df18f7f810a5becc4ec164480383b7a374bd4beb6beb46287fb09fc2085413cc68a6bfc234540e802ee50fdd73d6a3c2bc3a5423fa21868fbf8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-54760.exe

Filesize
468KB

MD5
c2f5832c15d3de8f2f8220592d55d0ff

SHA1
efe248f5dc176828d92f0492e67ce748cf4355d6

SHA256
53cf6cd91ca44a1338535c028a59ced70ba6bbebca2d7fc88c91c0a7cc183904

SHA512
6730ab300bf53f483d18224c760ee3cad7f83d7fbc048e3bacca505e0924d85253f27d2a8c36489a1cd00f571dad7200db2bf955db52812196da30a8b755fba6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-65346.exe

Filesize
468KB

MD5
8b5ce67dd4d96d6696d9dce26a48bbbb

SHA1
cab5488b083c5013630ef89c5b2864fb4b2f9191

SHA256
e59af9d033270160c3ca2e3e6c8707789396fe78eea893b0ed6ffe60aba8f1fd

SHA512
cc4a021811506db8f856ce3df244c5b6bee32a68ffce620e828b54a545a5c95e1aac4b6fbab00a42c3476aef8ab5a0d379c58ca297b6e80cd7b95d25302e6501

Download Submit