fdefb5420ac24e7a1bcf35d689bcc71d1f7d6f37f81c3d39b5e2a0f939614d9e

Analysis

max time kernel
109s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14/09/2024, 12:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

64a4ffb99f4d6e18394658b305e94710N.exe
Size

468KB
MD5

64a4ffb99f4d6e18394658b305e94710
SHA1

7df04213601eef7934a8727b392d181bb715c3ab
SHA256

fdefb5420ac24e7a1bcf35d689bcc71d1f7d6f37f81c3d39b5e2a0f939614d9e
SHA512

4ecf62058f52ba1b3b550c7a8c5b2fdaefb57f98d6375f0f086f50182f151fa9c65570f74839a36336ea546cf620b5abda227bb50a01b0d50de60e34949a0a17
SSDEEP

3072:5hT7oKI5I+5UtbYJHzciXf8lKChCPIpHnLHewVPK6PrLLmzggZlF:5hHoqqUtOH4iXff0qF6PvKzgg

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2496	Unicorn-5421.exe
2744	Unicorn-50896.exe
276	Unicorn-26946.exe
2784	Unicorn-60071.exe
2712	Unicorn-60626.exe
2896	Unicorn-10870.exe
2796	Unicorn-13100.exe
2732	Unicorn-28634.exe
2220	Unicorn-42732.exe
1660	Unicorn-3745.exe
1572	Unicorn-41248.exe
2804	Unicorn-61861.exe
1448	Unicorn-61114.exe
532	Unicorn-12105.exe
2860	Unicorn-41773.exe
1524	Unicorn-9399.exe
448	Unicorn-25736.exe
1928	Unicorn-5870.exe
2152	Unicorn-33712.exe
2164	Unicorn-33712.exe
2356	Unicorn-24781.exe
2364	Unicorn-30182.exe
2044	Unicorn-9207.exe
2544	Unicorn-5123.exe
2892	Unicorn-8942.exe
2232	Unicorn-63047.exe
948	Unicorn-35558.exe
1892	Unicorn-41688.exe
744	Unicorn-37604.exe
1732	Unicorn-64338.exe
2332	Unicorn-50603.exe
2540	Unicorn-43115.exe
1460	Unicorn-31609.exe
868	Unicorn-26587.exe
1204	Unicorn-27333.exe
1692	Unicorn-23847.exe
1936	Unicorn-39918.exe
2264	Unicorn-52627.exe
2672	Unicorn-62833.exe
2692	Unicorn-3426.exe
2524	Unicorn-3426.exe
2716	Unicorn-18609.exe
2844	Unicorn-40737.exe
2688	Unicorn-60603.exe
2728	Unicorn-52990.exe
2596	Unicorn-27547.exe
1980	Unicorn-52243.exe
348	Unicorn-32377.exe
3032	Unicorn-52243.exe
1848	Unicorn-48159.exe
2128	Unicorn-23006.exe
2532	Unicorn-23825.exe
2296	Unicorn-43691.exe
2888	Unicorn-13271.exe
2884	Unicorn-31116.exe
2472	Unicorn-50982.exe
3060	Unicorn-5163.exe
376	Unicorn-27630.exe
2484	Unicorn-36544.exe
2948	Unicorn-25391.exe
1268	Unicorn-31522.exe
2448	Unicorn-37836.exe
2020	Unicorn-19846.exe
2968	Unicorn-36928.exe

Loads dropped DLL 64 IoCs

pid	Process
2320	64a4ffb99f4d6e18394658b305e94710N.exe
2320	64a4ffb99f4d6e18394658b305e94710N.exe
2496	Unicorn-5421.exe
2496	Unicorn-5421.exe
2320	64a4ffb99f4d6e18394658b305e94710N.exe
2320	64a4ffb99f4d6e18394658b305e94710N.exe
2744	Unicorn-50896.exe
2744	Unicorn-50896.exe
2496	Unicorn-5421.exe
2496	Unicorn-5421.exe
276	Unicorn-26946.exe
276	Unicorn-26946.exe
2320	64a4ffb99f4d6e18394658b305e94710N.exe
2320	64a4ffb99f4d6e18394658b305e94710N.exe
2712	Unicorn-60626.exe
2712	Unicorn-60626.exe
2496	Unicorn-5421.exe
2496	Unicorn-5421.exe
2784	Unicorn-60071.exe
2784	Unicorn-60071.exe
2744	Unicorn-50896.exe
2744	Unicorn-50896.exe
2896	Unicorn-10870.exe
276	Unicorn-26946.exe
2796	Unicorn-13100.exe
2896	Unicorn-10870.exe
276	Unicorn-26946.exe
2796	Unicorn-13100.exe
2320	64a4ffb99f4d6e18394658b305e94710N.exe
2320	64a4ffb99f4d6e18394658b305e94710N.exe
532	Unicorn-12105.exe
532	Unicorn-12105.exe
2860	Unicorn-41773.exe
2860	Unicorn-41773.exe
2796	Unicorn-13100.exe
2796	Unicorn-13100.exe
2320	64a4ffb99f4d6e18394658b305e94710N.exe
1448	Unicorn-61114.exe
2220	Unicorn-42732.exe
2220	Unicorn-42732.exe
2320	64a4ffb99f4d6e18394658b305e94710N.exe
1448	Unicorn-61114.exe
2896	Unicorn-10870.exe
2896	Unicorn-10870.exe
2732	Unicorn-28634.exe
2804	Unicorn-61861.exe
2496	Unicorn-5421.exe
2732	Unicorn-28634.exe
2804	Unicorn-61861.exe
2496	Unicorn-5421.exe
2712	Unicorn-60626.exe
2712	Unicorn-60626.exe
276	Unicorn-26946.exe
1572	Unicorn-41248.exe
276	Unicorn-26946.exe
1572	Unicorn-41248.exe
1660	Unicorn-3745.exe
1660	Unicorn-3745.exe
2784	Unicorn-60071.exe
2744	Unicorn-50896.exe
2784	Unicorn-60071.exe
2744	Unicorn-50896.exe
448	Unicorn-25736.exe
448	Unicorn-25736.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4276	3056	WerFault.exe	117

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43748.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16841.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56670.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33712.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5123.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36442.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56832.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-913.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9238.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43111.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6841.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13203.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41786.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57329.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32045.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18609.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9451.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48460.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12757.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26492.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43680.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49617.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44637.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47437.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2684.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13203.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56501.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42320.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60510.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61413.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31609.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9197.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36273.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38054.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-913.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57785.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51805.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13203.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33919.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19706.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36784.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58282.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49617.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44333.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41812.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55548.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51805.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20224.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24344.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49922.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43255.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29213.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52990.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27345.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12938.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41786.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56501.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33712.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56701.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26492.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62833.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41786.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2320	64a4ffb99f4d6e18394658b305e94710N.exe
2496	Unicorn-5421.exe
2744	Unicorn-50896.exe
276	Unicorn-26946.exe
2784	Unicorn-60071.exe
2712	Unicorn-60626.exe
2896	Unicorn-10870.exe
2796	Unicorn-13100.exe
2220	Unicorn-42732.exe
2732	Unicorn-28634.exe
532	Unicorn-12105.exe
1660	Unicorn-3745.exe
1448	Unicorn-61114.exe
2804	Unicorn-61861.exe
1572	Unicorn-41248.exe
2860	Unicorn-41773.exe
1524	Unicorn-9399.exe
448	Unicorn-25736.exe
2364	Unicorn-30182.exe
2164	Unicorn-33712.exe
2152	Unicorn-33712.exe
2356	Unicorn-24781.exe
2044	Unicorn-9207.exe
1928	Unicorn-5870.exe
2544	Unicorn-5123.exe
2892	Unicorn-8942.exe
2232	Unicorn-63047.exe
948	Unicorn-35558.exe
1892	Unicorn-41688.exe
744	Unicorn-37604.exe
1732	Unicorn-64338.exe
2332	Unicorn-50603.exe
2540	Unicorn-43115.exe
1460	Unicorn-31609.exe
868	Unicorn-26587.exe
1692	Unicorn-23847.exe
1936	Unicorn-39918.exe
2672	Unicorn-62833.exe
2264	Unicorn-52627.exe
2524	Unicorn-3426.exe
2692	Unicorn-3426.exe
2716	Unicorn-18609.exe
2688	Unicorn-60603.exe
2844	Unicorn-40737.exe
2728	Unicorn-52990.exe
2596	Unicorn-27547.exe
1980	Unicorn-52243.exe
348	Unicorn-32377.exe
1848	Unicorn-48159.exe
3032	Unicorn-52243.exe
2128	Unicorn-23006.exe
2296	Unicorn-43691.exe
2532	Unicorn-23825.exe
2472	Unicorn-50982.exe
3060	Unicorn-5163.exe
2888	Unicorn-13271.exe
2884	Unicorn-31116.exe
376	Unicorn-27630.exe
2484	Unicorn-36544.exe
1268	Unicorn-31522.exe
2948	Unicorn-25391.exe
2448	Unicorn-37836.exe
2968	Unicorn-36928.exe
2020	Unicorn-19846.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2496	2320	64a4ffb99f4d6e18394658b305e94710N.exe	29
PID 2320 wrote to memory of 2496	2320	64a4ffb99f4d6e18394658b305e94710N.exe	29
PID 2320 wrote to memory of 2496	2320	64a4ffb99f4d6e18394658b305e94710N.exe	29
PID 2320 wrote to memory of 2496	2320	64a4ffb99f4d6e18394658b305e94710N.exe	29
PID 2496 wrote to memory of 2744	2496	Unicorn-5421.exe	30
PID 2496 wrote to memory of 2744	2496	Unicorn-5421.exe	30
PID 2496 wrote to memory of 2744	2496	Unicorn-5421.exe	30
PID 2496 wrote to memory of 2744	2496	Unicorn-5421.exe	30
PID 2320 wrote to memory of 276	2320	64a4ffb99f4d6e18394658b305e94710N.exe	31
PID 2320 wrote to memory of 276	2320	64a4ffb99f4d6e18394658b305e94710N.exe	31
PID 2320 wrote to memory of 276	2320	64a4ffb99f4d6e18394658b305e94710N.exe	31
PID 2320 wrote to memory of 276	2320	64a4ffb99f4d6e18394658b305e94710N.exe	31
PID 2744 wrote to memory of 2784	2744	Unicorn-50896.exe	32
PID 2744 wrote to memory of 2784	2744	Unicorn-50896.exe	32
PID 2744 wrote to memory of 2784	2744	Unicorn-50896.exe	32
PID 2744 wrote to memory of 2784	2744	Unicorn-50896.exe	32
PID 2496 wrote to memory of 2712	2496	Unicorn-5421.exe	33
PID 2496 wrote to memory of 2712	2496	Unicorn-5421.exe	33
PID 2496 wrote to memory of 2712	2496	Unicorn-5421.exe	33
PID 2496 wrote to memory of 2712	2496	Unicorn-5421.exe	33
PID 276 wrote to memory of 2896	276	Unicorn-26946.exe	34
PID 276 wrote to memory of 2896	276	Unicorn-26946.exe	34
PID 276 wrote to memory of 2896	276	Unicorn-26946.exe	34
PID 276 wrote to memory of 2896	276	Unicorn-26946.exe	34
PID 2320 wrote to memory of 2796	2320	64a4ffb99f4d6e18394658b305e94710N.exe	35
PID 2320 wrote to memory of 2796	2320	64a4ffb99f4d6e18394658b305e94710N.exe	35
PID 2320 wrote to memory of 2796	2320	64a4ffb99f4d6e18394658b305e94710N.exe	35
PID 2320 wrote to memory of 2796	2320	64a4ffb99f4d6e18394658b305e94710N.exe	35
PID 2712 wrote to memory of 2732	2712	Unicorn-60626.exe	36
PID 2712 wrote to memory of 2732	2712	Unicorn-60626.exe	36
PID 2712 wrote to memory of 2732	2712	Unicorn-60626.exe	36
PID 2712 wrote to memory of 2732	2712	Unicorn-60626.exe	36
PID 2496 wrote to memory of 2220	2496	Unicorn-5421.exe	37
PID 2496 wrote to memory of 2220	2496	Unicorn-5421.exe	37
PID 2496 wrote to memory of 2220	2496	Unicorn-5421.exe	37
PID 2496 wrote to memory of 2220	2496	Unicorn-5421.exe	37
PID 2784 wrote to memory of 1660	2784	Unicorn-60071.exe	38
PID 2784 wrote to memory of 1660	2784	Unicorn-60071.exe	38
PID 2784 wrote to memory of 1660	2784	Unicorn-60071.exe	38
PID 2784 wrote to memory of 1660	2784	Unicorn-60071.exe	38
PID 2744 wrote to memory of 1572	2744	Unicorn-50896.exe	39
PID 2744 wrote to memory of 1572	2744	Unicorn-50896.exe	39
PID 2744 wrote to memory of 1572	2744	Unicorn-50896.exe	39
PID 2744 wrote to memory of 1572	2744	Unicorn-50896.exe	39
PID 2896 wrote to memory of 1448	2896	Unicorn-10870.exe	40
PID 2896 wrote to memory of 1448	2896	Unicorn-10870.exe	40
PID 2896 wrote to memory of 1448	2896	Unicorn-10870.exe	40
PID 2896 wrote to memory of 1448	2896	Unicorn-10870.exe	40
PID 276 wrote to memory of 2804	276	Unicorn-26946.exe	41
PID 276 wrote to memory of 2804	276	Unicorn-26946.exe	41
PID 276 wrote to memory of 2804	276	Unicorn-26946.exe	41
PID 276 wrote to memory of 2804	276	Unicorn-26946.exe	41
PID 2796 wrote to memory of 532	2796	Unicorn-13100.exe	42
PID 2796 wrote to memory of 532	2796	Unicorn-13100.exe	42
PID 2796 wrote to memory of 532	2796	Unicorn-13100.exe	42
PID 2796 wrote to memory of 532	2796	Unicorn-13100.exe	42
PID 2320 wrote to memory of 2860	2320	64a4ffb99f4d6e18394658b305e94710N.exe	43
PID 2320 wrote to memory of 2860	2320	64a4ffb99f4d6e18394658b305e94710N.exe	43
PID 2320 wrote to memory of 2860	2320	64a4ffb99f4d6e18394658b305e94710N.exe	43
PID 2320 wrote to memory of 2860	2320	64a4ffb99f4d6e18394658b305e94710N.exe	43
PID 532 wrote to memory of 1524	532	Unicorn-12105.exe	44
PID 532 wrote to memory of 1524	532	Unicorn-12105.exe	44
PID 532 wrote to memory of 1524	532	Unicorn-12105.exe	44
PID 532 wrote to memory of 1524	532	Unicorn-12105.exe	44

C:\Users\Admin\AppData\Local\Temp\64a4ffb99f4d6e18394658b305e94710N.exe
"C:\Users\Admin\AppData\Local\Temp\64a4ffb99f4d6e18394658b305e94710N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5421.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5421.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50896.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50896.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60071.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60071.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3745.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37604.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50982.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6649.exe
        8⤵
        
        PID:580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33701.exe
        8⤵
        
        PID:3912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47655.exe
        8⤵
        
        PID:4708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58282.exe
        8⤵
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52129.exe
        7⤵
        
        PID:1252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47437.exe
        7⤵
        
        PID:3888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53520.exe
        7⤵
        
        PID:1852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49617.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36544.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30962.exe
        7⤵
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33701.exe
        7⤵
        
        PID:3904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47655.exe
        7⤵
        
        PID:4744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58282.exe
        7⤵
        
        PID:5640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32807.exe
        6⤵
        
        PID:1212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28798.exe
        6⤵
        
        PID:4004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54791.exe
        6⤵
        
        PID:4604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23608.exe
        6⤵
        
        PID:6008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50603.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27630.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6649.exe
        7⤵
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57329.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47720.exe
        7⤵
        
        PID:5396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43961.exe
        6⤵
        
        PID:2060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47437.exe
        6⤵
        
        PID:3812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5789.exe
        6⤵
        
        PID:4640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3333.exe
        6⤵
        
        PID:5908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25391.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18710.exe
        6⤵
        
        PID:2812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33701.exe
        6⤵
        
        PID:3804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41786.exe
        6⤵
        
        PID:3740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28578.exe
        6⤵
        
        PID:4848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52269.exe
        5⤵
        
        PID:2028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38986.exe
        5⤵
        
        PID:3724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3377.exe
        5⤵
        
        PID:2200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41248.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41248.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41688.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27547.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41849.exe
        7⤵
        
        PID:2984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56701.exe
        8⤵
        
        PID:2408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25009.exe
        8⤵
        
        PID:3200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39973.exe
        8⤵
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58875.exe
        7⤵
        
        PID:3124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30576.exe
        7⤵
        
        PID:3620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58282.exe
        7⤵
        
        PID:5608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48905.exe
        6⤵
        
        PID:1456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53302.exe
        6⤵
        
        PID:3760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44855.exe
        6⤵
        
        PID:4684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28997.exe
        6⤵
        
        PID:5560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32377.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61693.exe
        6⤵
        
        PID:2724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13203.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13224.exe
        7⤵
        
        PID:4796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52417.exe
        7⤵
        
        PID:5524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47852.exe
        6⤵
        
        PID:3768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61413.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49617.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43119.exe
        5⤵
        
        PID:1708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13203.exe
        6⤵
        
        PID:3228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16841.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36273.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12938.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39837.exe
        5⤵
        
        PID:3612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41249.exe
        5⤵
        
        PID:5020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64338.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64338.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23847.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3364.exe
        6⤵
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56317.exe
        7⤵
        
        PID:2140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16841.exe
        7⤵
        
        PID:3540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7384.exe
        7⤵
        
        PID:5736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60764.exe
        6⤵
        
        PID:2092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8896.exe
        6⤵
        
        PID:4216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50474.exe
        6⤵
        
        PID:5924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4111.exe
        5⤵
        
        PID:1896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13203.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37069.exe
        6⤵
        
        PID:4104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48333.exe
        6⤵
        
        PID:5576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7073.exe
        5⤵
        
        PID:1428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32358.exe
        5⤵
        
        PID:3584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37556.exe
        5⤵
        
        PID:332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39918.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39918.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-903.exe
        5⤵
        
        PID:1604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48664.exe
        5⤵
        
        PID:4500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33081.exe
        5⤵
        
        PID:5664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61206.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61206.exe
      4⤵
      PID:1504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45399.exe
        5⤵
        
        PID:4084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33919.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60585.exe
        5⤵
        
        PID:2008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4012.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4012.exe
      4⤵
      PID:3828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53278.exe
      4⤵
      PID:4628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28616.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28616.exe
      4⤵
      PID:5532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60626.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60626.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28634.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28634.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9207.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60603.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29104.exe
        7⤵
        
        PID:2208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10593.exe
        8⤵
        
        PID:3672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33919.exe
        8⤵
        
        PID:4716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52417.exe
        8⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39544.exe
        7⤵
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55548.exe
        7⤵
        
        PID:4672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-913.exe
        7⤵
        
        PID:5188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48905.exe
        6⤵
        
        PID:2292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53302.exe
        6⤵
        
        PID:3764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44855.exe
        6⤵
        
        PID:4492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28943.exe
        6⤵
        
        PID:5348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52990.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47422.exe
        6⤵
        
        PID:2428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47437.exe
        6⤵
        
        PID:3880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53520.exe
        6⤵
        
        PID:4768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51805.exe
        6⤵
        
        PID:5896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36186.exe
        5⤵
        
        PID:856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56701.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28901.exe
        6⤵
        
        PID:4160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60585.exe
        6⤵
        
        PID:4872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12938.exe
        5⤵
        
        PID:3152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24344.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50147.exe
        5⤵
        
        PID:5360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63047.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63047.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52627.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25788.exe
        6⤵
        
        PID:2824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6841.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41153.exe
        7⤵
        
        PID:3984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60585.exe
        7⤵
        
        PID:4908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48896.exe
        6⤵
        
        PID:1032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38745.exe
        6⤵
        
        PID:660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49922.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26150.exe
        5⤵
        
        PID:2640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10157.exe
        6⤵
        
        PID:2616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9197.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47655.exe
        6⤵
        
        PID:4736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38054.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42320.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47651.exe
        5⤵
        
        PID:3728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19912.exe
        5⤵
        
        PID:4836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62833.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62833.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52373.exe
        5⤵
        
        PID:2224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13203.exe
        6⤵
        
        PID:3236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43680.exe
        6⤵
        
        PID:4452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58282.exe
        6⤵
        
        PID:5592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58875.exe
        5⤵
        
        PID:3116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26492.exe
        5⤵
        
        PID:3688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-913.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43748.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39706.exe
        5⤵
        
        PID:3000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43680.exe
        5⤵
        
        PID:4460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58282.exe
        5⤵
        
        PID:5656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43111.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43111.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11241.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11241.exe
      4⤵
      PID:3512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43255.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43255.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42732.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42732.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33712.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33712.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52243.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3940.exe
        6⤵
        
        PID:976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42207.exe
        7⤵
        
        PID:2432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1121.exe
        8⤵
        
        PID:4912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33718.exe
        7⤵
        
        PID:4992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58053.exe
        7⤵
        
        PID:5940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56358.exe
        6⤵
        
        PID:560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47437.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53520.exe
        6⤵
        
        PID:1888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45533.exe
        6⤵
        
        PID:5504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53696.exe
        5⤵
        
        PID:2396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56265.exe
        6⤵
        
        PID:3660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47655.exe
        6⤵
        
        PID:4760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58282.exe
        6⤵
        
        PID:5624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53280.exe
        5⤵
        
        PID:3960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62883.exe
        5⤵
        
        PID:4544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3333.exe
        5⤵
        
        PID:5884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23825.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23825.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29104.exe
        5⤵
        
        PID:616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60510.exe
        6⤵
        
        PID:2952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28050.exe
        6⤵
        
        PID:3920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22712.exe
        6⤵
        
        PID:4804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20224.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41786.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28578.exe
        5⤵
        
        PID:5056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22973.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22973.exe
      4⤵
      PID:2400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62451.exe
        5⤵
        
        PID:3500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41812.exe
        5⤵
        
        PID:4616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56501.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29213.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29213.exe
      4⤵
      PID:3856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56832.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56832.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41249.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41249.exe
      4⤵
      PID:5068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8942.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8942.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57204.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57204.exe
      4⤵
      PID:1608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31922.exe
        5⤵
        
        PID:1744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28050.exe
        5⤵
        
        PID:3736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22712.exe
        5⤵
        
        PID:4088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4795.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4795.exe
      4⤵
      PID:2620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56670.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56670.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57785.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57785.exe
      4⤵
      PID:4928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13271.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13271.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8024.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8024.exe
      4⤵
      PID:1836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55134.exe
        5⤵
        
        PID:4020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41812.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52417.exe
        5⤵
        
        PID:5704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39544.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39544.exe
      4⤵
      PID:3968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55548.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-913.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-913.exe
      4⤵
      PID:5180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16383.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16383.exe
    3⤵
    PID:3012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-90.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-90.exe
      4⤵
      PID:2476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33919.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33919.exe
      4⤵
      PID:4700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56501.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56501.exe
      4⤵
      PID:5148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21077.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21077.exe
    3⤵
    PID:3872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31747.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31747.exe
    3⤵
    PID:4560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23281.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23281.exe
    3⤵
    PID:5352
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26946.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26946.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10870.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10870.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61114.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33712.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3426.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20936.exe
        7⤵
        
        PID:1956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13203.exe
        8⤵
        
        PID:3320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12757.exe
        8⤵
        
        PID:3640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60585.exe
        8⤵
        
        PID:5104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58875.exe
        7⤵
        
        PID:3140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26492.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-913.exe
        7⤵
        
        PID:5156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51231.exe
        6⤵
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11968.exe
        7⤵
        
        PID:2584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37069.exe
        7⤵
        
        PID:4120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56501.exe
        7⤵
        
        PID:2316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50571.exe
        6⤵
        
        PID:2464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36442.exe
        6⤵
        
        PID:3520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13052.exe
        6⤵
        
        PID:4888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40737.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61693.exe
        6⤵
        
        PID:268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13203.exe
        7⤵
        
        PID:3264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37069.exe
        7⤵
        
        PID:4136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60585.exe
        7⤵
        
        PID:5236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63006.exe
        6⤵
        
        PID:3528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55548.exe
        6⤵
        
        PID:4656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58282.exe
        6⤵
        
        PID:5552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55371.exe
        5⤵
        
        PID:2748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32045.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56265.exe
        6⤵
        
        PID:3656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47655.exe
        6⤵
        
        PID:4756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-913.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41942.exe
        5⤵
        
        PID:3004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13757.exe
        6⤵
        
        PID:6100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44637.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28319.exe
        5⤵
        
        PID:4528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34963.exe
        5⤵
        
        PID:5872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30182.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30182.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31522.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30962.exe
        6⤵
        
        PID:2600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8247.exe
        6⤵
        
        PID:2568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50805.exe
        6⤵
        
        PID:3632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58282.exe
        6⤵
        
        PID:5600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19072.exe
        5⤵
        
        PID:2084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22932.exe
        5⤵
        
        PID:3988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5789.exe
        5⤵
        
        PID:4576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16937.exe
        5⤵
        
        PID:980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37836.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37836.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60510.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28050.exe
        5⤵
        
        PID:3948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22712.exe
        5⤵
        
        PID:4808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2684.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2684.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32128.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32128.exe
      4⤵
      PID:4512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34003.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34003.exe
      4⤵
      PID:4904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61861.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61861.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5123.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5123.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48159.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15424.exe
        6⤵
        
        PID:2708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62726.exe
        7⤵
        
        PID:3644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65107.exe
        7⤵
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2803.exe
        7⤵
        
        PID:5976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60074.exe
        6⤵
        
        PID:3712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55548.exe
        6⤵
        
        PID:4648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58282.exe
        6⤵
        
        PID:5544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33659.exe
        5⤵
        
        PID:552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13203.exe
        6⤵
        
        PID:3256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37069.exe
        6⤵
        
        PID:4052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7959.exe
        6⤵
        
        PID:5912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7073.exe
        5⤵
        
        PID:3076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56670.exe
        5⤵
        
        PID:3556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53701.exe
        5⤵
        
        PID:5164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31116.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31116.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8024.exe
        5⤵
        
        PID:2876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13203.exe
        6⤵
        
        PID:3244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17033.exe
        6⤵
        
        PID:4324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56501.exe
        6⤵
        
        PID:5220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58875.exe
        5⤵
        
        PID:3132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50805.exe
        5⤵
        
        PID:3628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-913.exe
        5⤵
        
        PID:5140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35719.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35719.exe
      4⤵
      PID:3056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14293.exe
        5⤵
        
        PID:2240
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 216
        5⤵
        Program crash
        
        PID:4276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29213.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29213.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52748.exe
      4⤵
      PID:4532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33081.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33081.exe
      4⤵
      PID:5684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35558.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35558.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52243.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52243.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10473.exe
        5⤵
        
        PID:1208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47437.exe
        5⤵
        
        PID:3848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53520.exe
        5⤵
        
        PID:2916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51805.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9238.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9238.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13203.exe
        5⤵
        
        PID:3280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37069.exe
        5⤵
        
        PID:4128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56501.exe
        5⤵
        
        PID:5212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7073.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7073.exe
      4⤵
      PID:3044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56670.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56670.exe
      4⤵
      PID:3492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57785.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57785.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23006.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23006.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44973.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44973.exe
      4⤵
      PID:2684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11968.exe
        5⤵
        
        PID:2676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37069.exe
        5⤵
        
        PID:3196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56501.exe
        5⤵
        
        PID:5228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8247.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8247.exe
      4⤵
      PID:1656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26492.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26492.exe
      4⤵
      PID:4044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-913.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-913.exe
      4⤵
      PID:4856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19706.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19706.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13203.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13203.exe
      4⤵
      PID:3296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37069.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37069.exe
      4⤵
      PID:4076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52417.exe
      4⤵
      PID:5720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53275.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53275.exe
    3⤵
    PID:264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40367.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40367.exe
    3⤵
    PID:4152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36784.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36784.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4036
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13100.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13100.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12105.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12105.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9399.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9399.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26587.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56602.exe
        6⤵
        
        PID:1940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42316.exe
        7⤵
        
        PID:1300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60510.exe
        8⤵
        
        PID:1044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28050.exe
        8⤵
        
        PID:3928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22712.exe
        8⤵
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20224.exe
        7⤵
        
        PID:2068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41786.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28578.exe
        7⤵
        
        PID:4568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10006.exe
        6⤵
        
        PID:2668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13203.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37069.exe
        7⤵
        
        PID:4144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11468.exe
        7⤵
        
        PID:5988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7073.exe
        6⤵
        
        PID:3108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36442.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33472.exe
        6⤵
        
        PID:4944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24723.exe
        5⤵
        
        PID:2280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13203.exe
        6⤵
        
        PID:3288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37069.exe
        6⤵
        
        PID:3212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60585.exe
        6⤵
        
        PID:5172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7073.exe
        5⤵
        
        PID:3092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60754.exe
        5⤵
        
        PID:4012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53701.exe
        5⤵
        
        PID:5128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27333.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27333.exe
      4⤵
      Executes dropped EXE
      PID:1204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12793.exe
        5⤵
        
        PID:2344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27345.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43680.exe
        6⤵
        
        PID:4432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58282.exe
        6⤵
        
        PID:5632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37219.exe
        5⤵
        
        PID:2272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26492.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33408.exe
        5⤵
        
        PID:5880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39528.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39528.exe
      4⤵
      PID:1328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44833.exe
        5⤵
        
        PID:2248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37069.exe
        5⤵
        
        PID:4064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56501.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48460.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48460.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48005.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48005.exe
      4⤵
      PID:1140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37165.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37165.exe
      4⤵
      PID:5288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5870.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5870.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43691.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43691.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58735.exe
        5⤵
        
        PID:2000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60510.exe
        6⤵
        
        PID:1028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28050.exe
        6⤵
        
        PID:3996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22712.exe
        6⤵
        
        PID:4820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12056.exe
        5⤵
        
        PID:1700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41786.exe
        5⤵
        
        PID:3700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28578.exe
        5⤵
        
        PID:4828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59565.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59565.exe
      4⤵
      PID:1712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17183.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17183.exe
      4⤵
      PID:5000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54231.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54231.exe
      4⤵
      PID:5464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5163.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5163.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29104.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29104.exe
      4⤵
      PID:2004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42483.exe
        5⤵
        
        PID:4964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36683.exe
        5⤵
        
        PID:5332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9612.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9612.exe
      4⤵
      PID:3836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59632.exe
      4⤵
      PID:4472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33408.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33408.exe
      4⤵
      PID:5904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28839.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28839.exe
    3⤵
    PID:596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13203.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13203.exe
      4⤵
      PID:3220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43680.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43680.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58282.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58282.exe
      4⤵
      PID:5648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4273.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4273.exe
    3⤵
    PID:3084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11241.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11241.exe
    3⤵
    PID:3580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23608.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23608.exe
    3⤵
    PID:6000
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41773.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41773.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25736.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25736.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43115.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43115.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19846.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32581.exe
        6⤵
        
        PID:1248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12757.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44333.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32943.exe
        5⤵
        
        PID:2836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34660.exe
        5⤵
        
        PID:3364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-913.exe
        5⤵
        
        PID:5044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36928.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10925.exe
        5⤵
        
        PID:3028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37069.exe
        5⤵
        
        PID:4112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52417.exe
        5⤵
        
        PID:5712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12086.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12086.exe
      4⤵
      PID:864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36442.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36442.exe
      4⤵
      PID:3568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19132.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19132.exe
      4⤵
      PID:5540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31609.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31609.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3317.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3317.exe
      4⤵
      PID:1528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39706.exe
        5⤵
        
        PID:2864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43680.exe
        5⤵
        
        PID:4444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58282.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32175.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32175.exe
      4⤵
      PID:1728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30576.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30576.exe
      4⤵
      PID:3608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42138.exe
      4⤵
      PID:4932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50472.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50472.exe
    3⤵
    PID:1560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57884.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57884.exe
      4⤵
      PID:1784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47584.exe
        5⤵
        
        PID:4788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38681.exe
        5⤵
        
        PID:5568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39544.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39544.exe
      4⤵
      PID:3952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5435.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5435.exe
      4⤵
      PID:4312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51805.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51805.exe
      4⤵
      PID:5932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42051.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42051.exe
    3⤵
    PID:1576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38402.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38402.exe
      4⤵
      PID:5968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20547.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20547.exe
    3⤵
    PID:3820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36212.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36212.exe
    3⤵
    PID:4552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50147.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50147.exe
    3⤵
    PID:5368
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24781.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24781.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3426.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3426.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39322.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39322.exe
      4⤵
      PID:2928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41786.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41786.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28578.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28578.exe
      4⤵
      PID:4540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55829.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55829.exe
    3⤵
    PID:2564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6212.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6212.exe
    3⤵
    PID:3216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53520.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53520.exe
    3⤵
    PID:4776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51805.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51805.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5952
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18609.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18609.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9451.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9451.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15284.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15284.exe
      4⤵
      PID:2696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3031.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3031.exe
      4⤵
      PID:4256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35667.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35667.exe
      4⤵
      PID:5752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48320.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48320.exe
    3⤵
    PID:996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49545.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49545.exe
    3⤵
    PID:4420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57785.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57785.exe
    3⤵
    PID:5196
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47128.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47128.exe
  2⤵
  PID:1804
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23636.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23636.exe
  2⤵
  PID:3784
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18519.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18519.exe
  2⤵
  PID:4728
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31565.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31565.exe
  2⤵
  PID:4876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-42316.exe

Filesize
468KB

MD5
42905587ac1a0b4c33e15708a8d23195

SHA1
4f0401669e337016d61ac73ad0e442b5dd3e0740

SHA256
7fe8a0df0db7616325da151b46eee4746d09888efe1744c367d84e7002be5787

SHA512
aac7b1400687bf83ebe2f6219df587253d91b0ae04b0af3baab078acc25a57131787e834f64990ec7f9281477ba7426a9d13e3d64698df8b0c3db0a8a6befe01

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55134.exe

Filesize
468KB

MD5
dfb778a318a8790139a5eb90908fd9db

SHA1
7f9c96529d6bd64e9bb1d91f238e63e7c5949dac

SHA256
314b34bb297f8a2ec0519fb9bd3d60fb6bcc706d5446b3caac0cce5c2eab1f43

SHA512
842d360f3a42b3f479fd307787b9069370dec2fef3e3ebfd8065b14e768a272db42316e6b7d84791e10a688bf94589fc63c65ff4fcb82a451d6497ed0d05cefa

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-10870.exe

Filesize
468KB

MD5
a49b926d895d08c5e2cb4d9db4305def

SHA1
cf8a256f45b5ff2e5f58056f3374281e910d3322

SHA256
33fff3cb79c47bc6ad543a740cd76918a9ebb9189d043f6cd754e6140b79eb34

SHA512
28cb80cdb48ff017e6bb26031d9ac3bb64ca9348817ebf68eb1a8c30f4675cdca8b9508c2b9fd326389c7b88c351c179352d15525c9c6a49983eea010ab5fee9

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-12105.exe

Filesize
468KB

MD5
2af169e67919156f4186acffedcfd500

SHA1
9a7d864eb3f4c93d808d59f8c0b7cd0a8ccf5bb8

SHA256
aebd78e37914485a05a66d529039d8b6ce4cdf5c68d59db3aaf9535a5a75ddad

SHA512
f6da3ef05f4c2566bd4e5db79b081a66632d094345daa62f8623f49addb5c735aaa4321b2e50b9174423d2a3c6abbc45bf1b23592b686edc42a07e8c9c4e57ac

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-13100.exe

Filesize
468KB

MD5
fd0b7700ed571c01566e0ac550bec68a

SHA1
a24ad48710ebf0a84997c2341aa915571e757e65

SHA256
6f4006f5cfe479f8d5803e9849a94ae277a403d3b2d15bf10b8fea2b1669e864

SHA512
c313fd97935af987aef46916b2db40b473e8cff6cd2f17100700eeafbdd3bb9362efc5f8c3c262ef2dae6ddc1c0174d27cd36847a2a1ce957563acd0fbdb5886

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-25736.exe

Filesize
468KB

MD5
24d47460aa472cd4724f7a96381c66a8

SHA1
3309eb0ab2add1e2e298e3def0b3577933d28cfc

SHA256
0f7ff05b604455afe89cda0a94cb87e33dc47fbc8b3b03d8c1817872eeeec733

SHA512
a18fe24db1fcfe8196fa65a5dc0c3483098149d32ac40c509825d0b8c6105ba37abd4cca1e54358d038adceeff2298c246dd1168d3688b0f8b68517a5a6d9524

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-26946.exe

Filesize
468KB

MD5
4a79c5461a63b740aae76e7457cd2945

SHA1
a9f7e93927d16808648e349a85b168ff3f48c2ab

SHA256
a3d28231a24c9d69d0c97681b267d5fe2d2abf5d579996ec6656931615b324ed

SHA512
75efa6f4717e4e3903bb3998eeaf734e22573464e9bfc8dabb535a27cc767b7dbd7633e7b161184c2d3cc6f5bc3bd6621b390f03355be598d011afc0f5dce07d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-28634.exe

Filesize
468KB

MD5
1276a1f039c33b0df8297a9c6c153e7e

SHA1
2de7b5de1c46cf57fa1b2acde6e3fe39821ca7b0

SHA256
e98869ad78e6249271fd4b96d18cb102752f435ceda41f45a7b3df576c700839

SHA512
7808360c912e1b74041fe0dd92709ea6386545c4eeca3b729d15c0296553da487d770f5fd62ab197cf779b5cdbfb285470acf23cba5ae252afda37ce6bec5ace

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-3745.exe

Filesize
468KB

MD5
d70933be82a2c0f05b3ad94a6a7347f6

SHA1
639469e20dbe702a509504563d293d6d678ec028

SHA256
a6466e935d7be6eb24ed5a0e983cb714a97969174957d47ba52050df3a861101

SHA512
4a16f03a56fd3b7fdd906b879b16536ff09051012a908e1035f3e9f253dc45d5b615d72bf1fd67db99597b970bbf18c6814c7cbce3fe881ee89c4c3ee8465d40

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-41248.exe

Filesize
468KB

MD5
cf9f52db54931edd0525a457da436e99

SHA1
2a982a7ac8997686b7f6f7b856f7b8995756ca38

SHA256
d9240335be1557ed5d409edc1b3fbeea78bdfa3cb0205c2f874dfc0bf6e9a519

SHA512
cd9479c49c6dedd638df6f2eb1c5931ff0e7a5110941d3e7c7f4d97d2dd738566abdd3f9c74fc3869c693faebbf9a9ba7fd6c7b62a2f060d619d74406968302d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-41773.exe

Filesize
468KB

MD5
5e7b03eba8dc179791f4e9f4a4a790e7

SHA1
93ce0af4b3b3ce3f0cfef1598e743f0141d0af29

SHA256
fbf0e2bbc08aa6b74c7b57da7d74015c9d7248529e750000c4a5f9cfb65d5a2d

SHA512
5ddf4afa7513016c7f6d8ab518836f7f5c0e594013bb3d121fd9ec0c3ae80411826351fb925b9408c6632e8cd827f19cd0093da0dc1bcd5da31c350bb6e5eed7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-42732.exe

Filesize
468KB

MD5
51027c4bc0f5732a34bf17ce5d374ab0

SHA1
5d130da538c8154cd7beb6542e894e8b6ae63be7

SHA256
d7761928c40a03dec2928e6fbd797edd252a6a3d31461b5690c0707cac08f9ca

SHA512
ae693bff3d5113c5c78687a51d903dd3f63a18096049ded921df621785b89c0aafb2f23a246690fc3b47249c1d12869a9bdd6fca99615b29ab4b0798ece81078

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-50896.exe

Filesize
468KB

MD5
a5b7ff613c97483614cd224b46372b7d

SHA1
1d3ec9a3d3a9610985a33ab93feb7eb84fba237f

SHA256
498ab4a5ed0b3cc1455148aa4cc2a83f382c57f569cecb44bab0acf9f052861b

SHA512
d7e45db8b37a2f948a4fbb98b311d9706b5929febcbe7b1be006f6edb3d735b7b4681107cca056d00775a2ae6024b722c42cf27dc486c268b63e6265564a9fea

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-5421.exe

Filesize
468KB

MD5
0c0e1d338b6bd908507f351b7efb094c

SHA1
3aed3137355e7a671566741f79adcdb2eabc2a29

SHA256
779d1540c80471a6845fc0844e99adb4347f82ed721a0e909217bfc9d51d588a

SHA512
bfcb80dfd119812b3912111bfb85d3481e4aaaa2e46b61e9d053fc97355d86c2fd0d7ee203142dabf8a3235c5528ac1f32210cec58902a4c67eb1146b4fcdc0d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-5870.exe

Filesize
468KB

MD5
d4bc58ed537f35729fab3429d418cb3b

SHA1
210e9f697fa323ae559380033dce813d32a29b86

SHA256
3d19203e455822877e585a19677d33819f9ab8d99518728974a613afc277bbc7

SHA512
e0a3bd1da4e5ae210df5e1f10e43bfc8271771c734f51deecfaf4b34675a69f4da6787151a4b81b523a1d85a897e019e87ec2b2d32d26a5fc64a52c8b800f56e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-60071.exe

Filesize
468KB

MD5
dcf71611ab142e2f58652a66be910928

SHA1
429054d78f136e25d72fba76f690f227aef09139

SHA256
8e286ceb911cf0b0bc53ca9f65cc8b62dc8b818a3a52d34588fe86fe0cda7967

SHA512
018c9fd099bc0c18cc2c6e78ae5d368075d9fbe4cdcc29326ae0c6586d49003026e27456894c854c03398901b09586f7e790cf36ae74d65ef0b4536e34eb67e8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-60626.exe

Filesize
468KB

MD5
e5adb3b2a1c3a057c6154fe08645076d

SHA1
f2771dd130b7966c01c4cfc6eaecac77ba0d1917

SHA256
783be1c89a4c481b0703f3b95835e17d7e160a3559087c44cdd6bd4b9b1d0d35

SHA512
84ca31b511760d2e4fd979c397530e460623b081128a6fb2eb6e13725841711808b1be97a97fd0bbda1326b8bd23ff4ad119b471a832a30630069acac01ba60f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-61114.exe

Filesize
468KB

MD5
a2d64803fb09696e4b42048db967222b

SHA1
f9784b3967660edee11d902045f51ddd0e3495c1

SHA256
5172c0ca0ccd69f153a0665da9a6860da9b3cf2c64920f154719703b824786da

SHA512
a8d04bc7c941eb31d894041043518198067b7ed7fa7d245216ed6c2b52d1f444431abc9fad21f5e05f2c4789644bab6a61cb2aac94f87c40939fb763aece6c1b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-61861.exe

Filesize
468KB

MD5
79e23f01b6d5c0fddee711e230c38b9e

SHA1
858e9ab8d40de0acd3c91ee837e61d954b7c42cc

SHA256
7a1a7dd8c558aa3932021c3ce213e7b6c261251ca827ef3453da92e1546bf7af

SHA512
6ee70c94a831737e3dcd2f00cd43a861bde697ee5a3b8c13406921e9fe4efea678528c6604c6cd47c205eec779b048c7047a66a1178b9edb00eb937c86351e12

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-9399.exe

Filesize
468KB

MD5
1a334c65e559086a7eb1859c5f58b42f

SHA1
68065b940ee5c4f2f85427b874b3e1843a6ff545

SHA256
45ce0b5b69b2c44cca848ea94fe3a1f34fa28ca0ccaea7c429e39f80a2610b9c

SHA512
6e1e0c316444e7f21c5319b03dea0f2665327f9c1b4002413e8372ba9f6ea603112780c3d1d5fb3b71bf2264af104ae6ab11f9639e11e7512b9f727c766e7095

Download Submit