64d426be297e7155e18f2213783fa7b37717fb8083fe5f2a77b033e8963fec92

Analysis

max time kernel
117s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08-09-2024 10:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

403652821035d0616b1129b8266d11c0N.exe
Size

468KB
MD5

403652821035d0616b1129b8266d11c0
SHA1

c1fc423687647550a8f061da62ad06f25514fcdc
SHA256

64d426be297e7155e18f2213783fa7b37717fb8083fe5f2a77b033e8963fec92
SHA512

f5c3626aef31748dcf65a74571908c5351fd4780938b23b810676accaa3fdb5f606da91314161ccbe620543d0cdd081c7c03645101e29dd1ebb7032bd1372912
SSDEEP

3072:tqonoiLNjy8U6bYPfz5jYf5EChAoIpBnmHePVsOqsVGX18N+Glw:tqEoWLU6kf1jYfR03ZqsIl8N+

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2684	Unicorn-43942.exe
2428	Unicorn-43003.exe
2732	Unicorn-19053.exe
2608	Unicorn-38016.exe
2900	Unicorn-55976.exe
2824	Unicorn-4174.exe
1988	Unicorn-10304.exe
3024	Unicorn-50434.exe
1052	Unicorn-19624.exe
1924	Unicorn-47658.exe
2988	Unicorn-10444.exe
2348	Unicorn-10709.exe
2672	Unicorn-4579.exe
3016	Unicorn-56381.exe
2416	Unicorn-57855.exe
1640	Unicorn-62494.exe
972	Unicorn-39333.exe
1368	Unicorn-59199.exe
2940	Unicorn-44709.exe
2064	Unicorn-46371.exe
924	Unicorn-59692.exe
660	Unicorn-28865.exe
1552	Unicorn-7486.exe
648	Unicorn-7751.exe
1016	Unicorn-15920.exe
592	Unicorn-61591.exe
2540	Unicorn-45063.exe
2832	Unicorn-14440.exe
2868	Unicorn-17456.exe
2708	Unicorn-63127.exe
2628	Unicorn-15217.exe
2828	Unicorn-51005.exe
3008	Unicorn-7926.exe
3036	Unicorn-22225.exe
1228	Unicorn-18695.exe
1220	Unicorn-14056.exe
3020	Unicorn-54632.exe
276	Unicorn-54705.exe
1512	Unicorn-15763.exe
2216	Unicorn-60133.exe
1092	Unicorn-10475.exe
1028	Unicorn-27077.exe
1800	Unicorn-22993.exe
2492	Unicorn-35799.exe
1056	Unicorn-55665.exe
1760	Unicorn-56220.exe
1636	Unicorn-26885.exe
1276	Unicorn-10548.exe
2088	Unicorn-23355.exe
2984	Unicorn-50843.exe
1500	Unicorn-56973.exe
2524	Unicorn-2926.exe
2804	Unicorn-17586.exe
2720	Unicorn-26308.exe
2624	Unicorn-9225.exe
2644	Unicorn-62873.exe
280	Unicorn-9033.exe
1252	Unicorn-50953.exe
2432	Unicorn-2017.exe
2692	Unicorn-1825.exe
1328	Unicorn-29843.exe
1736	Unicorn-30968.exe
264	Unicorn-50834.exe
1616	Unicorn-33543.exe

Loads dropped DLL 64 IoCs

pid	Process
2504	403652821035d0616b1129b8266d11c0N.exe
2504	403652821035d0616b1129b8266d11c0N.exe
2684	Unicorn-43942.exe
2684	Unicorn-43942.exe
2504	403652821035d0616b1129b8266d11c0N.exe
2504	403652821035d0616b1129b8266d11c0N.exe
2732	Unicorn-19053.exe
2732	Unicorn-19053.exe
2684	Unicorn-43942.exe
2684	Unicorn-43942.exe
2428	Unicorn-43003.exe
2504	403652821035d0616b1129b8266d11c0N.exe
2428	Unicorn-43003.exe
2504	403652821035d0616b1129b8266d11c0N.exe
2608	Unicorn-38016.exe
2608	Unicorn-38016.exe
2732	Unicorn-19053.exe
2732	Unicorn-19053.exe
1988	Unicorn-10304.exe
1988	Unicorn-10304.exe
2504	403652821035d0616b1129b8266d11c0N.exe
2824	Unicorn-4174.exe
2684	Unicorn-43942.exe
2428	Unicorn-43003.exe
2504	403652821035d0616b1129b8266d11c0N.exe
2824	Unicorn-4174.exe
2684	Unicorn-43942.exe
2428	Unicorn-43003.exe
596	WerFault.exe
596	WerFault.exe
596	WerFault.exe
596	WerFault.exe
596	WerFault.exe
596	WerFault.exe
596	WerFault.exe
596	WerFault.exe
596	WerFault.exe
3024	Unicorn-50434.exe
3024	Unicorn-50434.exe
2608	Unicorn-38016.exe
2608	Unicorn-38016.exe
2900	Unicorn-55976.exe
1052	Unicorn-19624.exe
2900	Unicorn-55976.exe
1052	Unicorn-19624.exe
2732	Unicorn-19053.exe
2732	Unicorn-19053.exe
3016	Unicorn-56381.exe
3016	Unicorn-56381.exe
2672	Unicorn-4579.exe
2672	Unicorn-4579.exe
2428	Unicorn-43003.exe
2428	Unicorn-43003.exe
2684	Unicorn-43942.exe
2684	Unicorn-43942.exe
2348	Unicorn-10709.exe
2348	Unicorn-10709.exe
2824	Unicorn-4174.exe
2824	Unicorn-4174.exe
1924	Unicorn-47658.exe
1924	Unicorn-47658.exe
1988	Unicorn-10304.exe
1988	Unicorn-10304.exe
2416	Unicorn-57855.exe

Program crash 4 IoCs

pid	pid_target	Process	procid_target
596	2988	WerFault.exe	40
2856	2708	WerFault.exe	61
2376	2644	WerFault.exe	88
4200	2052	WerFault.exe	113

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54723.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14440.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7926.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34624.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8038.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13299.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35293.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17456.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34073.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51262.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1241.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33957.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29703.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32634.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25750.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19617.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45397.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32952.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22175.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39218.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58989.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38500.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51005.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62393.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37966.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43600.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51527.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11458.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31879.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39218.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30365.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29834.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26061.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33894.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4750.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50834.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9837.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50255.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33352.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61941.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30365.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51672.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51527.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8448.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19044.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18652.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29123.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34416.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31545.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29597.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36499.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47310.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26885.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39218.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6401.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21102.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39218.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57658.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3499.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55976.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61591.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28650.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46371.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63925.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2504	403652821035d0616b1129b8266d11c0N.exe
2684	Unicorn-43942.exe
2732	Unicorn-19053.exe
2428	Unicorn-43003.exe
2608	Unicorn-38016.exe
2900	Unicorn-55976.exe
1988	Unicorn-10304.exe
2824	Unicorn-4174.exe
3024	Unicorn-50434.exe
1052	Unicorn-19624.exe
1924	Unicorn-47658.exe
2988	Unicorn-10444.exe
2672	Unicorn-4579.exe
3016	Unicorn-56381.exe
2348	Unicorn-10709.exe
2416	Unicorn-57855.exe
1640	Unicorn-62494.exe
972	Unicorn-39333.exe
1368	Unicorn-59199.exe
2940	Unicorn-44709.exe
2064	Unicorn-46371.exe
924	Unicorn-59692.exe
660	Unicorn-28865.exe
648	Unicorn-7751.exe
1016	Unicorn-15920.exe
1552	Unicorn-7486.exe
2540	Unicorn-45063.exe
592	Unicorn-61591.exe
2832	Unicorn-14440.exe
2868	Unicorn-17456.exe
2708	Unicorn-63127.exe
2628	Unicorn-15217.exe
3008	Unicorn-7926.exe
3020	Unicorn-54632.exe
1220	Unicorn-14056.exe
3036	Unicorn-22225.exe
2828	Unicorn-51005.exe
1228	Unicorn-18695.exe
276	Unicorn-54705.exe
2216	Unicorn-60133.exe
1512	Unicorn-15763.exe
1092	Unicorn-10475.exe
1028	Unicorn-27077.exe
2492	Unicorn-35799.exe
1800	Unicorn-22993.exe
1056	Unicorn-55665.exe
1636	Unicorn-26885.exe
1276	Unicorn-10548.exe
1760	Unicorn-56220.exe
2088	Unicorn-23355.exe
2984	Unicorn-50843.exe
1500	Unicorn-56973.exe
2524	Unicorn-2926.exe
2804	Unicorn-17586.exe
2720	Unicorn-26308.exe
2624	Unicorn-9225.exe
2644	Unicorn-62873.exe
280	Unicorn-9033.exe
2432	Unicorn-2017.exe
1252	Unicorn-50953.exe
1328	Unicorn-29843.exe
2692	Unicorn-1825.exe
1736	Unicorn-30968.exe
264	Unicorn-50834.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 2684	2504	403652821035d0616b1129b8266d11c0N.exe	30
PID 2504 wrote to memory of 2684	2504	403652821035d0616b1129b8266d11c0N.exe	30
PID 2504 wrote to memory of 2684	2504	403652821035d0616b1129b8266d11c0N.exe	30
PID 2504 wrote to memory of 2684	2504	403652821035d0616b1129b8266d11c0N.exe	30
PID 2684 wrote to memory of 2428	2684	Unicorn-43942.exe	31
PID 2684 wrote to memory of 2428	2684	Unicorn-43942.exe	31
PID 2684 wrote to memory of 2428	2684	Unicorn-43942.exe	31
PID 2684 wrote to memory of 2428	2684	Unicorn-43942.exe	31
PID 2504 wrote to memory of 2732	2504	403652821035d0616b1129b8266d11c0N.exe	32
PID 2504 wrote to memory of 2732	2504	403652821035d0616b1129b8266d11c0N.exe	32
PID 2504 wrote to memory of 2732	2504	403652821035d0616b1129b8266d11c0N.exe	32
PID 2504 wrote to memory of 2732	2504	403652821035d0616b1129b8266d11c0N.exe	32
PID 2732 wrote to memory of 2608	2732	Unicorn-19053.exe	33
PID 2732 wrote to memory of 2608	2732	Unicorn-19053.exe	33
PID 2732 wrote to memory of 2608	2732	Unicorn-19053.exe	33
PID 2732 wrote to memory of 2608	2732	Unicorn-19053.exe	33
PID 2684 wrote to memory of 2900	2684	Unicorn-43942.exe	34
PID 2684 wrote to memory of 2900	2684	Unicorn-43942.exe	34
PID 2684 wrote to memory of 2900	2684	Unicorn-43942.exe	34
PID 2684 wrote to memory of 2900	2684	Unicorn-43942.exe	34
PID 2428 wrote to memory of 1988	2428	Unicorn-43003.exe	35
PID 2428 wrote to memory of 1988	2428	Unicorn-43003.exe	35
PID 2428 wrote to memory of 1988	2428	Unicorn-43003.exe	35
PID 2428 wrote to memory of 1988	2428	Unicorn-43003.exe	35
PID 2504 wrote to memory of 2824	2504	403652821035d0616b1129b8266d11c0N.exe	36
PID 2504 wrote to memory of 2824	2504	403652821035d0616b1129b8266d11c0N.exe	36
PID 2504 wrote to memory of 2824	2504	403652821035d0616b1129b8266d11c0N.exe	36
PID 2504 wrote to memory of 2824	2504	403652821035d0616b1129b8266d11c0N.exe	36
PID 2608 wrote to memory of 3024	2608	Unicorn-38016.exe	37
PID 2608 wrote to memory of 3024	2608	Unicorn-38016.exe	37
PID 2608 wrote to memory of 3024	2608	Unicorn-38016.exe	37
PID 2608 wrote to memory of 3024	2608	Unicorn-38016.exe	37
PID 2732 wrote to memory of 1052	2732	Unicorn-19053.exe	38
PID 2732 wrote to memory of 1052	2732	Unicorn-19053.exe	38
PID 2732 wrote to memory of 1052	2732	Unicorn-19053.exe	38
PID 2732 wrote to memory of 1052	2732	Unicorn-19053.exe	38
PID 1988 wrote to memory of 1924	1988	Unicorn-10304.exe	39
PID 1988 wrote to memory of 1924	1988	Unicorn-10304.exe	39
PID 1988 wrote to memory of 1924	1988	Unicorn-10304.exe	39
PID 1988 wrote to memory of 1924	1988	Unicorn-10304.exe	39
PID 2504 wrote to memory of 2988	2504	403652821035d0616b1129b8266d11c0N.exe	40
PID 2504 wrote to memory of 2988	2504	403652821035d0616b1129b8266d11c0N.exe	40
PID 2504 wrote to memory of 2988	2504	403652821035d0616b1129b8266d11c0N.exe	40
PID 2504 wrote to memory of 2988	2504	403652821035d0616b1129b8266d11c0N.exe	40
PID 2824 wrote to memory of 2348	2824	Unicorn-4174.exe	41
PID 2824 wrote to memory of 2348	2824	Unicorn-4174.exe	41
PID 2824 wrote to memory of 2348	2824	Unicorn-4174.exe	41
PID 2824 wrote to memory of 2348	2824	Unicorn-4174.exe	41
PID 2684 wrote to memory of 2672	2684	Unicorn-43942.exe	42
PID 2684 wrote to memory of 2672	2684	Unicorn-43942.exe	42
PID 2684 wrote to memory of 2672	2684	Unicorn-43942.exe	42
PID 2684 wrote to memory of 2672	2684	Unicorn-43942.exe	42
PID 2428 wrote to memory of 3016	2428	Unicorn-43003.exe	43
PID 2428 wrote to memory of 3016	2428	Unicorn-43003.exe	43
PID 2428 wrote to memory of 3016	2428	Unicorn-43003.exe	43
PID 2428 wrote to memory of 3016	2428	Unicorn-43003.exe	43
PID 2988 wrote to memory of 596	2988	Unicorn-10444.exe	44
PID 2988 wrote to memory of 596	2988	Unicorn-10444.exe	44
PID 2988 wrote to memory of 596	2988	Unicorn-10444.exe	44
PID 2988 wrote to memory of 596	2988	Unicorn-10444.exe	44
PID 3024 wrote to memory of 2416	3024	Unicorn-50434.exe	45
PID 3024 wrote to memory of 2416	3024	Unicorn-50434.exe	45
PID 3024 wrote to memory of 2416	3024	Unicorn-50434.exe	45
PID 3024 wrote to memory of 2416	3024	Unicorn-50434.exe	45

C:\Users\Admin\AppData\Local\Temp\403652821035d0616b1129b8266d11c0N.exe
"C:\Users\Admin\AppData\Local\Temp\403652821035d0616b1129b8266d11c0N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Users\Admin\AppData\Local\Temp\Unicorn-43942.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-43942.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43003.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43003.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10304.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10304.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47658.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15920.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22993.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53823.exe
        8⤵
        
        PID:1320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7318.exe
        9⤵
        
        PID:2332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14251.exe
        9⤵
        
        PID:3688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12787.exe
        9⤵
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38500.exe
        9⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34073.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39218.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29312.exe
        8⤵
        
        PID:4332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13299.exe
        8⤵
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58270.exe
        7⤵
        
        PID:2488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52990.exe
        8⤵
        
        PID:2780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23902.exe
        8⤵
        
        PID:3940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34989.exe
        8⤵
        
        PID:4616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25750.exe
        8⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1707.exe
        7⤵
        
        PID:856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33852.exe
        7⤵
        
        PID:3540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57658.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24978.exe
        7⤵
        
        PID:5808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56220.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34624.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39218.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25228.exe
        7⤵
        
        PID:4596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29635.exe
        7⤵
        
        PID:5624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62393.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21102.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58989.exe
        6⤵
        
        PID:4424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30365.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45063.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10548.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18445.exe
        7⤵
        
        PID:912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4900.exe
        8⤵
        
        PID:3384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19617.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28028.exe
        8⤵
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38500.exe
        8⤵
        
        PID:5220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31661.exe
        7⤵
        
        PID:3792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36332.exe
        7⤵
        
        PID:3496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38500.exe
        7⤵
        
        PID:5308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51672.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40204.exe
        7⤵
        
        PID:1976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9201.exe
        7⤵
        
        PID:3472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38500.exe
        7⤵
        
        PID:5204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34073.exe
        6⤵
        
        PID:2012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39218.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25228.exe
        6⤵
        
        PID:4660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37803.exe
        6⤵
        
        PID:5748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50843.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30580.exe
        6⤵
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35715.exe
        7⤵
        
        PID:1556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59176.exe
        7⤵
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29123.exe
        7⤵
        
        PID:4772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63004.exe
        7⤵
        
        PID:5720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37421.exe
        6⤵
        
        PID:1908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33352.exe
        6⤵
        
        PID:3552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37978.exe
        6⤵
        
        PID:4344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54339.exe
        6⤵
        
        PID:5740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27383.exe
        5⤵
        
        PID:1916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48185.exe
        6⤵
        
        PID:2512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4739.exe
        6⤵
        
        PID:3424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29123.exe
        6⤵
        
        PID:4740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38500.exe
        6⤵
        
        PID:5236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40132.exe
        5⤵
        
        PID:2008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4567.exe
        5⤵
        
        PID:3988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26854.exe
        5⤵
        
        PID:4552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4750.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56381.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56381.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:3016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46371.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54705.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65499.exe
        7⤵
        
        PID:1100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31879.exe
        7⤵
        
        PID:3564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15066.exe
        7⤵
        
        PID:2476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29834.exe
        7⤵
        
        PID:5284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9837.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48180.exe
        7⤵
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9201.exe
        7⤵
        
        PID:3660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34416.exe
        7⤵
        
        PID:5516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52247.exe
        6⤵
        
        PID:3216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6401.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13299.exe
        6⤵
        
        PID:5268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15763.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38390.exe
        6⤵
        
        PID:2084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57287.exe
        7⤵
        
        PID:792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19617.exe
        7⤵
        
        PID:3288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28028.exe
        7⤵
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34416.exe
        7⤵
        
        PID:5388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54718.exe
        6⤵
        
        PID:684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33352.exe
        6⤵
        
        PID:3596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57128.exe
        6⤵
        
        PID:4524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1732.exe
        6⤵
        
        PID:5912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50625.exe
        5⤵
        
        PID:2532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4739.exe
        6⤵
        
        PID:3448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29123.exe
        6⤵
        
        PID:4788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34416.exe
        6⤵
        
        PID:5476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43831.exe
        5⤵
        
        PID:3080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30552.exe
        5⤵
        
        PID:3396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12777.exe
        5⤵
        
        PID:4380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26281.exe
        5⤵
        
        PID:5696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28865.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60133.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1825.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15780.exe
        7⤵
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31661.exe
        7⤵
        
        PID:3880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36499.exe
        7⤵
        
        PID:5004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33714.exe
        7⤵
        
        PID:5848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64116.exe
        6⤵
        
        PID:1844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29597.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44475.exe
        8⤵
        
        PID:3236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60889.exe
        8⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52671.exe
        8⤵
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36508.exe
        7⤵
        
        PID:2880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49544.exe
        7⤵
        
        PID:4668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38500.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45397.exe
        6⤵
        
        PID:3696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17692.exe
        6⤵
        
        PID:1332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25750.exe
        6⤵
        
        PID:5468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30968.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50541.exe
        6⤵
        
        PID:1156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31661.exe
        6⤵
        
        PID:3752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36499.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29834.exe
        6⤵
        
        PID:4852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12314.exe
        5⤵
        
        PID:880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22482.exe
        5⤵
        
        PID:3972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33531.exe
        5⤵
        
        PID:3480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9215.exe
        5⤵
        
        PID:5372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10475.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10475.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50834.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43600.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51527.exe
        7⤵
        
        PID:3768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43016.exe
        7⤵
        
        PID:4136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28550.exe
        7⤵
        
        PID:5560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31661.exe
        6⤵
        
        PID:3816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36499.exe
        6⤵
        
        PID:4996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29834.exe
        6⤵
        
        PID:3032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25078.exe
        5⤵
        
        PID:2928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45397.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27833.exe
        5⤵
        
        PID:5012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13299.exe
        5⤵
        
        PID:5316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33543.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33543.exe
      4⤵
      Executes dropped EXE
      PID:1616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64324.exe
        5⤵
        
        PID:3120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19617.exe
        5⤵
        
        PID:3348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28028.exe
        5⤵
        
        PID:4652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34416.exe
        5⤵
        
        PID:5500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14738.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14738.exe
      4⤵
      PID:2292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31083.exe
      4⤵
      PID:3492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8312.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8312.exe
      4⤵
      PID:4320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3499.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3499.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55976.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55976.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39333.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39333.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51005.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36335.exe
        6⤵
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31661.exe
        7⤵
        
        PID:3864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40416.exe
        7⤵
        
        PID:2456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34416.exe
        7⤵
        
        PID:5532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20338.exe
        6⤵
        
        PID:1292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1745.exe
        6⤵
        
        PID:3148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29834.exe
        6⤵
        
        PID:5244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16469.exe
        5⤵
        
        PID:2260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11434.exe
        6⤵
        
        PID:4824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10918.exe
        6⤵
        
        PID:5692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37966.exe
        5⤵
        
        PID:1476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39218.exe
        5⤵
        
        PID:4080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25228.exe
        5⤵
        
        PID:4500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64376.exe
        5⤵
        
        PID:5956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7926.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7926.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19807.exe
        5⤵
        
        PID:2140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51527.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22596.exe
        6⤵
        
        PID:4072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32634.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50764.exe
        5⤵
        
        PID:3188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15066.exe
        5⤵
        
        PID:3152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25750.exe
        5⤵
        
        PID:5508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53558.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53558.exe
      4⤵
      PID:1424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41704.exe
        5⤵
        
        PID:3228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16898.exe
        5⤵
        
        PID:5048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57139.exe
        5⤵
        
        PID:5684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45171.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45171.exe
      4⤵
      PID:3276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6931.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6931.exe
      4⤵
      PID:3244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4750.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4750.exe
      4⤵
      PID:5356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4579.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4579.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59692.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59692.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55665.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56755.exe
        6⤵
        
        PID:2468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51527.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30633.exe
        7⤵
        
        PID:5036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34416.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28314.exe
        6⤵
        
        PID:3044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33352.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57128.exe
        6⤵
        
        PID:4516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10092.exe
        6⤵
        
        PID:5572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49142.exe
        5⤵
        
        PID:1600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24605.exe
        6⤵
        
        PID:3500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45814.exe
        6⤵
        
        PID:4212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24274.exe
        6⤵
        
        PID:5616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37966.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39218.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25228.exe
        5⤵
        
        PID:4648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9215.exe
        5⤵
        
        PID:5432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23355.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23355.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34624.exe
        5⤵
        
        PID:996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34073.exe
        5⤵
        
        PID:2736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6401.exe
        5⤵
        
        PID:3136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63377.exe
        5⤵
        
        PID:5632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8038.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8038.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24340.exe
      4⤵
      PID:3372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11298.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11298.exe
      4⤵
      PID:4976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30365.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30365.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7486.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7486.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56973.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56973.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32059.exe
        5⤵
        
        PID:2032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15780.exe
        6⤵
        
        PID:1472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31661.exe
        6⤵
        
        PID:3872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36332.exe
        6⤵
        
        PID:2316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38500.exe
        6⤵
        
        PID:5260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64116.exe
        5⤵
        
        PID:1544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32952.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42197.exe
        5⤵
        
        PID:4000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25750.exe
        5⤵
        
        PID:5460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5369.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5369.exe
      4⤵
      PID:2656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8310.exe
        5⤵
        
        PID:5104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32490.exe
        5⤵
        
        PID:5920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39803.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39803.exe
      4⤵
      PID:3328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39218.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39218.exe
      4⤵
      PID:4064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25228.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25228.exe
      4⤵
      PID:4712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16244.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16244.exe
      4⤵
      PID:6000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2926.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2926.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65499.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65499.exe
      4⤵
      PID:1136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8191.exe
        5⤵
        
        PID:4544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24644.exe
        5⤵
        
        PID:5804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31879.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31879.exe
      4⤵
      PID:3572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61941.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61941.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22711.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22711.exe
      4⤵
      PID:4836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25750.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25750.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4237.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4237.exe
    3⤵
    PID:784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43127.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43127.exe
    3⤵
    PID:3744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20699.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20699.exe
    3⤵
    PID:4288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3499.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3499.exe
    3⤵
    PID:5196
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19053.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19053.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38016.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38016.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50434.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57855.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14440.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17586.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31661.exe
        8⤵
        
        PID:3840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40416.exe
        8⤵
        
        PID:3476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50250.exe
        8⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54718.exe
        7⤵
        
        PID:2588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33352.exe
        7⤵
        
        PID:3548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33894.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47310.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26308.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35741.exe
        7⤵
        
        PID:3012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10167.exe
        7⤵
        
        PID:3964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29123.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34416.exe
        7⤵
        
        PID:5524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1188.exe
        6⤵
        
        PID:2660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30552.exe
        6⤵
        
        PID:3340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56241.exe
        6⤵
        
        PID:4844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54723.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63127.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2708
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2708 -s 200
        6⤵
        Program crash
        
        PID:2856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27939.exe
        5⤵
        
        PID:2436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29768.exe
        5⤵
        
        PID:3916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38576.exe
        5⤵
        
        PID:4484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9215.exe
        5⤵
        
        PID:5408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62494.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62494.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17456.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9225.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34624.exe
        7⤵
        
        PID:844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23902.exe
        7⤵
        
        PID:3984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34989.exe
        7⤵
        
        PID:4624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25750.exe
        7⤵
        
        PID:5364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64116.exe
        6⤵
        
        PID:1852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8448.exe
        6⤵
        
        PID:4008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27833.exe
        6⤵
        
        PID:5028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13299.exe
        6⤵
        
        PID:5168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62873.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2644
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 220
        6⤵
        Program crash
        
        PID:2376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7053.exe
        5⤵
        
        PID:2136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25186.exe
        5⤵
        
        PID:3600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9788.exe
        5⤵
        
        PID:4476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30365.exe
        5⤵
        
        PID:5212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15217.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15217.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9033.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29703.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35558.exe
        7⤵
        
        PID:5712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31661.exe
        6⤵
        
        PID:3856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28163.exe
        6⤵
        
        PID:4120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63846.exe
        6⤵
        
        PID:5968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62393.exe
        5⤵
        
        PID:1704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14017.exe
        5⤵
        
        PID:3296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25759.exe
        5⤵
        
        PID:4580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4750.exe
        5⤵
        
        PID:5440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50953.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49062.exe
        5⤵
        
        PID:2820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1999.exe
        5⤵
        
        PID:3100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12787.exe
        5⤵
        
        PID:4408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38500.exe
        5⤵
        
        PID:5152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63925.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63925.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4567.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4567.exe
      4⤵
      PID:3684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10517.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10517.exe
      4⤵
      PID:4356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8834.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8834.exe
      4⤵
      PID:4724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19624.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19624.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59199.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59199.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14056.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49355.exe
        6⤵
        
        PID:2424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55611.exe
        7⤵
        
        PID:3832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6260.exe
        7⤵
        
        PID:3532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32634.exe
        7⤵
        
        PID:5160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31879.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-488.exe
        6⤵
        
        PID:3208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22711.exe
        6⤵
        
        PID:4880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51120.exe
        6⤵
        
        PID:5896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8877.exe
        5⤵
        
        PID:2384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59093.exe
        6⤵
        
        PID:3056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4739.exe
        6⤵
        
        PID:3464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29123.exe
        6⤵
        
        PID:4796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34416.exe
        6⤵
        
        PID:5492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46139.exe
        5⤵
        
        PID:772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24340.exe
        5⤵
        
        PID:3380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26323.exe
        5⤵
        
        PID:4568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9215.exe
        5⤵
        
        PID:5484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18695.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18695.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64116.exe
        5⤵
        
        PID:696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8448.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27833.exe
        5⤵
        
        PID:4968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13299.exe
        5⤵
        
        PID:932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36702.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36702.exe
      4⤵
      PID:2364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30505.exe
        5⤵
        
        PID:2688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4739.exe
        5⤵
        
        PID:3408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12787.exe
        5⤵
        
        PID:4384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1241.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52004.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52004.exe
      4⤵
      PID:1648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15674.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15674.exe
      4⤵
      PID:3356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58989.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58989.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30365.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30365.exe
      4⤵
      PID:4764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44709.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44709.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22225.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22225.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19807.exe
        5⤵
        
        PID:2844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18445.exe
        6⤵
        
        PID:616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19217.exe
        6⤵
        
        PID:4052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56752.exe
        6⤵
        
        PID:4112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34416.exe
        6⤵
        
        PID:5400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59840.exe
        5⤵
        
        PID:1044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18474.exe
        5⤵
        
        PID:3400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34989.exe
        5⤵
        
        PID:4636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25750.exe
        5⤵
        
        PID:5416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33957.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33957.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18445.exe
        5⤵
        
        PID:2204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4739.exe
        5⤵
        
        PID:3432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29123.exe
        5⤵
        
        PID:4804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38500.exe
        5⤵
        
        PID:5252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28650.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28650.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24340.exe
      4⤵
      PID:3364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9987.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9987.exe
      4⤵
      PID:4432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13299.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13299.exe
      4⤵
      PID:5324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54632.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54632.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2017.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2017.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34624.exe
        5⤵
        
        PID:2184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23902.exe
        5⤵
        
        PID:3932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18652.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29834.exe
        5⤵
        
        PID:2128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64116.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64116.exe
      4⤵
      PID:2288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8448.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8448.exe
      4⤵
      PID:4016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17692.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17692.exe
      4⤵
      PID:1796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29834.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29834.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29843.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29843.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7152.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7152.exe
      4⤵
      PID:2412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4739.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4739.exe
      4⤵
      PID:3440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29123.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29123.exe
      4⤵
      PID:4780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38500.exe
      4⤵
      PID:5300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47908.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47908.exe
    3⤵
    PID:1108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25717.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25717.exe
    3⤵
    PID:3620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54523.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54523.exe
    3⤵
    PID:4452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3499.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3499.exe
    3⤵
    PID:5136
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4174.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4174.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10709.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10709.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7751.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7751.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27077.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42474.exe
        6⤵
        
        PID:2256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35907.exe
        7⤵
        
        PID:2276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65097.exe
        7⤵
        
        PID:3512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33207.exe
        7⤵
        
        PID:4584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19044.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60966.exe
        6⤵
        
        PID:1436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11458.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27833.exe
        6⤵
        
        PID:5020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9215.exe
        6⤵
        
        PID:5540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16469.exe
        5⤵
        
        PID:2096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3634.exe
        6⤵
        
        PID:3176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54174.exe
        6⤵
        
        PID:4904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9906.exe
        6⤵
        
        PID:5780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51262.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9027.exe
        5⤵
        
        PID:968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13299.exe
        5⤵
        
        PID:5176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35799.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35799.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29127.exe
        5⤵
        
        PID:2052
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 240
        6⤵
        Program crash
        
        PID:4200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22175.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33396.exe
        5⤵
        
        PID:4280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13299.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14636.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14636.exe
      4⤵
      PID:2116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11236.exe
        5⤵
        
        PID:1608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4739.exe
        5⤵
        
        PID:3452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29123.exe
        5⤵
        
        PID:4812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58920.exe
        5⤵
        
        PID:5656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28185.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28185.exe
      4⤵
      PID:2596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8278.exe
        5⤵
        
        PID:1804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61417.exe
        5⤵
        
        PID:4076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38500.exe
        5⤵
        
        PID:5128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64693.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64693.exe
      4⤵
      PID:2632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59147.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59147.exe
      4⤵
      PID:3200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8834.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8834.exe
      4⤵
      PID:4748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61591.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61591.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26885.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26885.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65364.exe
        5⤵
        
        PID:2848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31661.exe
        5⤵
        
        PID:3784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11827.exe
        5⤵
        
        PID:3224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38500.exe
        5⤵
        
        PID:1284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20802.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20802.exe
      4⤵
      PID:2680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45397.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45397.exe
      4⤵
      PID:3720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25861.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25861.exe
      4⤵
      PID:3944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50255.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50255.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6796.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6796.exe
    3⤵
    PID:1272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61088.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61088.exe
      4⤵
      PID:2996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31661.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31661.exe
      4⤵
      PID:3824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40416.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40416.exe
      4⤵
      PID:3580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38500.exe
      4⤵
      PID:4696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31545.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31545.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26061.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26061.exe
    3⤵
    PID:3808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9557.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9557.exe
    3⤵
    PID:2712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8834.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8834.exe
    3⤵
    PID:5144
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10444.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10444.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2988
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 200
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:596
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25541.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25541.exe
  2⤵
  PID:1560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54148.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54148.exe
    3⤵
    PID:3268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59928.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59928.exe
    3⤵
    PID:4532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35293.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35293.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5580
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26061.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26061.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3848
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54482.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54482.exe
  2⤵
  PID:4148
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8834.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8834.exe
  2⤵
  PID:5292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10304.exe

Filesize
468KB

MD5
288131bfad9f4614ec4e0359f4985c35

SHA1
3132b3738e78e44eb8d74b97bf80169f0a4833d3

SHA256
8fb227eee9f9bbfb568622e0e6298ac2544579b189cc9b8cf1383ef37807a78b

SHA512
4564b151de035af23a166743ca998d604cfd92a94919cd385093cc3597c4728cda9a0cbd6d0900b735c9c25d9c925fd35fe41fd8bade273b3d930388bc749889

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56381.exe

Filesize
468KB

MD5
eba9645f52a4fd8c06c6b7a2f4795142

SHA1
4f71d51b54173f4a185754573971b51efd67f987

SHA256
c59ff12ef9ae20e933572681a03b4305a21f51f75d0ade0c0fa268efa2d300ea

SHA512
ecb335fd704e09e484a048536d6496723175e7cea4696cf8e50f73389bdbb8e3c574fd4ba3e7e81ba9caed04248204d56b55608b099b53c3fdb54cddf1667142

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-10444.exe

Filesize
468KB

MD5
02ae6d6a173bb1e7d101b1aa24e52c6e

SHA1
87fc34bdc352b10e15e1ea4bd708ef3b40d134db

SHA256
c78da396ec99d1303352aa5e1f92963be4954281aa9f93d62d7d54ffe268c9ed

SHA512
3abbe067dcb9d19e5dd31b236b9b1235189b5e60f8dabf07420e4f19d5f949959e2fc76679a02ac6ab83c016fe6a03135ff1a5c5d22f1a61ed634c0f4b64b9df

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-10709.exe

Filesize
468KB

MD5
dd42e5b4a04e99320e96ea83f07c8155

SHA1
9639acab84d31678d118fc7cf87e96a0df7a3d2a

SHA256
b6eb300b52d70f21311f55d73eabbc79c1f1744c611bdfa5f8dd98feb542bcbd

SHA512
da7567a9929050dd3b069211b93a5ded7edcb4e4f999710c74b3b4d869b6220d819a5096cc6f4246818b43a632495ca3f2357129b0c9dfc4183a24c38c330004

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-19053.exe

Filesize
468KB

MD5
94dc9c1d2a311d92b36b1617bc17a210

SHA1
1b39e6070e43ab4a990919fc7c83294a724d2292

SHA256
d2cb7496a4d43e90485c749e1a1a6781dd81291bfb5fa21791258d5efd1d17be

SHA512
65708f823a8dc29740bfe89b818ed2829677b27ae2498333a8bb25c38347f237bda39271b5ca67319268d2e461634b044ad8726ad105ca8fd3f977c37fe0b699

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-19624.exe

Filesize
468KB

MD5
181d0c706ba421d611e9a76240dcd209

SHA1
4b24758e5339121557fb509fbbfe3b58dd1bb556

SHA256
ce6a62eef9d23ed4ca961013624d66ccc92f7b25ac3c6217771cd6e2ef6b4956

SHA512
8cd308caf7bce6939363f70c38d53cbe29ddc16b5c9e19ebb1c46a0f2e6574d4b61d62923f59170c889421f18405c41ad55f901d7f9c83ab53cff1e41ee58146

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-38016.exe

Filesize
468KB

MD5
e1bfdb82c6a7e3c669ec1aa586b23852

SHA1
5d420bd23bb25db5a527154fd9fc1c045b247861

SHA256
445f81abbb0921f24b0f5a7f3c59a5e1d1aa0ef85d47c40e8b5479b043afaa14

SHA512
068afde466458e0a57dd179dee5de91b3bb38b256141f73aa02107bc1ad6e045eb746a2dbd30d59581a9bf201da6b58d3d6ecf121575e244ff9e1bcfed175edb

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-4174.exe

Filesize
468KB

MD5
8330bb1d18030c5d9a22806c9552c550

SHA1
872a5476b601fa818c5ffb577111d7e1d5e902ea

SHA256
44fd134689ec3b2abfa6126d5ca78133817616c6833a18fb538a333fbfb3b20f

SHA512
db58f1b61db83f7fd83ae6d2b2c4d81d0f8868943efe7fe66d12aa9f58412c72b3d618c03dcc12bfcb8c75b0540611fa626c0cc2923ca138e2ef6b63b7a4e938

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-43003.exe

Filesize
468KB

MD5
e82e749922e1485be8ca0f9b3e20029b

SHA1
284704ece0185f15b8a4adafb07eb0c6fc653f65

SHA256
bfd432af905d921865b38ab59522fa08e1447bfb5bb11c35e75521d42994a98e

SHA512
c838f043b9e06ba46101507a92358482d64e201f0b8add5cc50490a7ebfdb92173f487e7b42225b6d63a8d25051fb03ae1c81320b71bf82e287d64e884376de8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-43942.exe

Filesize
468KB

MD5
4de79511fe25b8c2db19fccea0beef5d

SHA1
61a2a1cef93771c46bbf7c52d19502958566f73b

SHA256
0e8ae610a9eaea55415d934d18d24294e8ae858b600d7d579ba8a7a22ec6d3da

SHA512
7ac8703489ac45e1e7a719aaebd01446a41bfb4f59685a72d14100d5ad924086eb4e0b63110b98f7d58919cf3021c7b75550da8965a4025ee25cb1466ec6e615

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-4579.exe

Filesize
468KB

MD5
f321c80d02993258a8c768bfb10fbbfe

SHA1
aee88276f1600e978a9d99b21140ac5467d74cd4

SHA256
38154b48f9ba2f108e28a85939d063657886150d0f9ec3b329fe866cdc1825db

SHA512
b670ed20aa320ad83bfd2232d98a1760833de0fbe694f4a3a35299a0fac572e50f6f909e0fb058eb34ae05629cde00810e8145075ee7e9f43c1bfe3758688d68

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-47658.exe

Filesize
468KB

MD5
a782b3bdfecbc8f8bed9f521841f55c5

SHA1
cd88338a22a19cb5f2d654b177e63ffd4c6791c5

SHA256
a8e1be1b7ca1b72177a7be817067fceeef276fd9c43d8719e8d344edaa277d22

SHA512
23ba62fc7042f0427af51fbb0d32488ba0460bfedf6118964cd77ec04a9ab3c4542f3124238eda3c42f1c99e9d7a1f97e6d5bcb6a99a1cd152a7729c77b3dd0f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-50434.exe

Filesize
468KB

MD5
a53c65e4f4b585398333e088bec90120

SHA1
1212b80f6001780d53c96cb3260cb075e6140801

SHA256
ba9c506bb7dc9b3ab82e24c4cffd3aca58c5059c68230df692ccc5eda55b9b0e

SHA512
76cff6e5af2004eec7421060ee42e5a6f9c6f6d9cb88cb031998b49cc0884e7f76ecd737601bf721523b527ac24ee600bf2e5f774e3210da94ae6744c5a85980

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-55976.exe

Filesize
468KB

MD5
fb15fa578f53eb640231dc24b6c79d20

SHA1
ebe26e3328a7ad3bf8729e228f93490bb66fe2f4

SHA256
ca2269740f4b9804eb2156db7f1f1e03f3a70f3633b34bfe14f9c4e56faddd76

SHA512
67675854c15a933a24ce3ea71ec3fb341b6e594c3a92a8fdc403245dae9fb62fc3edf7c3f1f273a00772063ad5b867f4ee9afe148dea96949161542016db9dda

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-57855.exe

Filesize
468KB

MD5
301d116af695d5b8f19d1424f77d8578

SHA1
12f1e572bc3492e6f8ee3d1927eb420fc21137ed

SHA256
8f0da775d3697bc39595f9223e9eec30a8000e61a0942aecc7ebbab0b5f5bd61

SHA512
5a762d4d30c08465fce898d193adc3868bd0827340c7a8a46221baa89b1c7e2067d8adf462e18479cacc8b4fb2f897f67ef242d9f777cfd9612db8bcafc08b50

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-62494.exe

Filesize
468KB

MD5
6562199cd72487970923ddb8532aa107

SHA1
35a5901f81c8bdedeeca2bb0b597306b81f13c5f

SHA256
46339a09a39bd23946df34b18c5107c3cad803643b110e50e54f464da98380d3

SHA512
ee449abe7063a4c9abc631261c3646b5fbf0b7e4251228ab45556ebbd1525d19f523362d1468f66a9b0f7fb53523733966f9ed415b91a69393a3fa8e09096144

Download Submit
memory/276-415-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/592-294-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/648-290-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/660-261-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/924-250-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/972-219-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/972-360-0x0000000002650000-0x00000000026C5000-memory.dmp

Filesize
468KB

Download
memory/972-359-0x0000000002650000-0x00000000026C5000-memory.dmp

Filesize
468KB

Download
memory/1016-293-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1052-382-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1052-106-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1052-217-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1052-380-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1220-398-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1228-392-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1368-388-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1368-384-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1368-220-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1552-271-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1640-335-0x0000000003400000-0x0000000003475000-memory.dmp

Filesize
468KB

Download
memory/1640-334-0x0000000003400000-0x0000000003475000-memory.dmp

Filesize
468KB

Download
memory/1640-201-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1924-292-0x0000000002600000-0x0000000002675000-memory.dmp

Filesize
468KB

Download
memory/1924-117-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1988-300-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1988-301-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1988-79-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2064-410-0x0000000001D90000-0x0000000001E05000-memory.dmp

Filesize
468KB

Download
memory/2064-414-0x0000000001D90000-0x0000000001E05000-memory.dmp

Filesize
468KB

Download
memory/2064-247-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2348-148-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2348-288-0x0000000001F50000-0x0000000001FC5000-memory.dmp

Filesize
468KB

Download
memory/2348-273-0x0000000001F50000-0x0000000001FC5000-memory.dmp

Filesize
468KB

Download
memory/2416-192-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2416-320-0x0000000003450000-0x00000000034C5000-memory.dmp

Filesize
468KB

Download
memory/2428-260-0x0000000001CA0000-0x0000000001D15000-memory.dmp

Filesize
468KB

Download
memory/2428-32-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2428-259-0x0000000001CA0000-0x0000000001D15000-memory.dmp

Filesize
468KB

Download
memory/2428-160-0x0000000001CA0000-0x0000000001D15000-memory.dmp

Filesize
468KB

Download
memory/2428-391-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2428-139-0x0000000001CA0000-0x0000000001D15000-memory.dmp

Filesize
468KB

Download
memory/2504-11-0x00000000026B0000-0x0000000002725000-memory.dmp

Filesize
468KB

Download
memory/2504-128-0x00000000026B0000-0x0000000002725000-memory.dmp

Filesize
468KB

Download
memory/2504-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2504-10-0x00000000026B0000-0x0000000002725000-memory.dmp

Filesize
468KB

Download
memory/2504-140-0x00000000026B0000-0x0000000002725000-memory.dmp

Filesize
468KB

Download
memory/2504-319-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2540-302-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2608-48-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2608-349-0x00000000025C0000-0x0000000002635000-memory.dmp

Filesize
468KB

Download
memory/2608-90-0x00000000027C0000-0x0000000002835000-memory.dmp

Filesize
468KB

Download
memory/2608-199-0x00000000027C0000-0x0000000002835000-memory.dmp

Filesize
468KB

Download
memory/2608-200-0x00000000027C0000-0x0000000002835000-memory.dmp

Filesize
468KB

Download
memory/2628-353-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2672-159-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2672-251-0x00000000026F0000-0x0000000002765000-memory.dmp

Filesize
468KB

Download
memory/2672-252-0x00000000026F0000-0x0000000002765000-memory.dmp

Filesize
468KB

Download
memory/2684-269-0x0000000002600000-0x0000000002675000-memory.dmp

Filesize
468KB

Download
memory/2684-389-0x0000000002600000-0x0000000002675000-memory.dmp

Filesize
468KB

Download
memory/2684-62-0x0000000002600000-0x0000000002675000-memory.dmp

Filesize
468KB

Download
memory/2684-153-0x0000000002600000-0x0000000002675000-memory.dmp

Filesize
468KB

Download
memory/2684-270-0x0000000002600000-0x0000000002675000-memory.dmp

Filesize
468KB

Download
memory/2684-351-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2684-24-0x0000000002600000-0x0000000002675000-memory.dmp

Filesize
468KB

Download
memory/2684-138-0x0000000002600000-0x0000000002675000-memory.dmp

Filesize
468KB

Download
memory/2708-339-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2732-399-0x0000000001F40000-0x0000000001FB5000-memory.dmp

Filesize
468KB

Download
memory/2732-228-0x0000000001F40000-0x0000000001FB5000-memory.dmp

Filesize
468KB

Download
memory/2732-416-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2732-224-0x0000000001F40000-0x0000000001FB5000-memory.dmp

Filesize
468KB

Download
memory/2732-34-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2824-291-0x0000000002570000-0x00000000025E5000-memory.dmp

Filesize
468KB

Download
memory/2824-129-0x0000000002570000-0x00000000025E5000-memory.dmp

Filesize
468KB

Download
memory/2824-289-0x0000000002570000-0x00000000025E5000-memory.dmp

Filesize
468KB

Download
memory/2824-77-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2824-146-0x0000000002570000-0x00000000025E5000-memory.dmp

Filesize
468KB

Download
memory/2828-361-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2832-321-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2868-337-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2900-379-0x00000000024C0000-0x0000000002535000-memory.dmp

Filesize
468KB

Download
memory/2900-63-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2900-218-0x00000000024C0000-0x0000000002535000-memory.dmp

Filesize
468KB

Download
memory/2900-383-0x00000000024C0000-0x0000000002535000-memory.dmp

Filesize
468KB

Download
memory/2900-216-0x00000000024C0000-0x0000000002535000-memory.dmp

Filesize
468KB

Download
memory/2940-230-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3008-381-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3016-243-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/3016-241-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/3016-162-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3016-429-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/3020-402-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3024-338-0x0000000003370000-0x00000000033E5000-memory.dmp

Filesize
468KB

Download
memory/3024-190-0x0000000003370000-0x00000000033E5000-memory.dmp

Filesize
468KB

Download
memory/3024-189-0x0000000003370000-0x00000000033E5000-memory.dmp

Filesize
468KB

Download
memory/3024-336-0x0000000003370000-0x00000000033E5000-memory.dmp

Filesize
468KB

Download
memory/3036-390-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download