420664f5321b3f6690dba19987efc4ec7a127e0508cce4f9e2d121d1ddab4886

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

420664f5321b3f6690dba19987efc4ec7a127e0508cce4f9e2d121d1ddab4886N.exe
Size

468KB
MD5

941c058363e52deebbf7b4f93ab7a850
SHA1

06852b4760a1324e2447910f7b3f7bd9154cd21f
SHA256

420664f5321b3f6690dba19987efc4ec7a127e0508cce4f9e2d121d1ddab4886
SHA512

f783394275f969f86dc0015e14eeec06abef0270eda327256f6be1c1956386a35a2aed983f685334b4c9b583a6488fcb7426eb8c23c8a383280fcb52ed813a5b
SSDEEP

3072:ESgiogIyb45BtbYtPzqjQf8/ECOaZQpg8mHhQEhrHsBMWPuHHdEN:ES1ok4BtiP+jQfcsabHsukuHH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2524	Unicorn-20203.exe
1708	Unicorn-30805.exe
2320	Unicorn-13186.exe
2868	Unicorn-6741.exe
2848	Unicorn-16947.exe
2712	Unicorn-23078.exe
2620	Unicorn-11380.exe
2472	Unicorn-27131.exe
2648	Unicorn-18963.exe
1244	Unicorn-31769.exe
2844	Unicorn-47914.exe
2364	Unicorn-2242.exe
2584	Unicorn-61649.exe
2004	Unicorn-1977.exe
1952	Unicorn-10410.exe
2256	Unicorn-33156.exe
908	Unicorn-11946.exe
2236	Unicorn-24028.exe
2444	Unicorn-40364.exe
2116	Unicorn-64106.exe
1684	Unicorn-20009.exe
1892	Unicorn-5205.exe
1380	Unicorn-50644.exe
1812	Unicorn-58812.exe
1340	Unicorn-44322.exe
1508	Unicorn-50187.exe
1576	Unicorn-29517.exe
688	Unicorn-49383.exe
2152	Unicorn-31162.exe
1556	Unicorn-60094.exe
2420	Unicorn-23700.exe
2676	Unicorn-34246.exe
2172	Unicorn-60487.exe
2372	Unicorn-62896.exe
2204	Unicorn-52201.exe
2928	Unicorn-48672.exe
1356	Unicorn-60177.exe
2872	Unicorn-16383.exe
2908	Unicorn-52393.exe
2332	Unicorn-32527.exe
2628	Unicorn-23399.exe
2668	Unicorn-43265.exe
3052	Unicorn-26472.exe
988	Unicorn-13415.exe
1636	Unicorn-12246.exe
288	Unicorn-26545.exe
2888	Unicorn-26545.exe
828	Unicorn-34327.exe
3028	Unicorn-39927.exe
548	Unicorn-46472.exe
2024	Unicorn-54640.exe
1836	Unicorn-28718.exe
1644	Unicorn-17757.exe
1664	Unicorn-32056.exe
768	Unicorn-7173.exe
2892	Unicorn-15838.exe
2924	Unicorn-16104.exe
1140	Unicorn-50814.exe
2392	Unicorn-20619.exe
2180	Unicorn-65330.exe
832	Unicorn-60499.exe
1324	Unicorn-21504.exe
940	Unicorn-11874.exe
2900	Unicorn-41017.exe

Loads dropped DLL 64 IoCs

pid	Process
316	420664f5321b3f6690dba19987efc4ec7a127e0508cce4f9e2d121d1ddab4886N.exe
316	420664f5321b3f6690dba19987efc4ec7a127e0508cce4f9e2d121d1ddab4886N.exe
2524	Unicorn-20203.exe
2524	Unicorn-20203.exe
316	420664f5321b3f6690dba19987efc4ec7a127e0508cce4f9e2d121d1ddab4886N.exe
316	420664f5321b3f6690dba19987efc4ec7a127e0508cce4f9e2d121d1ddab4886N.exe
2320	Unicorn-13186.exe
2320	Unicorn-13186.exe
316	420664f5321b3f6690dba19987efc4ec7a127e0508cce4f9e2d121d1ddab4886N.exe
316	420664f5321b3f6690dba19987efc4ec7a127e0508cce4f9e2d121d1ddab4886N.exe
1708	Unicorn-30805.exe
2524	Unicorn-20203.exe
2524	Unicorn-20203.exe
1708	Unicorn-30805.exe
2620	Unicorn-11380.exe
2712	Unicorn-23078.exe
2620	Unicorn-11380.exe
2712	Unicorn-23078.exe
1708	Unicorn-30805.exe
1708	Unicorn-30805.exe
2320	Unicorn-13186.exe
2320	Unicorn-13186.exe
2524	Unicorn-20203.exe
2848	Unicorn-16947.exe
2524	Unicorn-20203.exe
2848	Unicorn-16947.exe
2868	Unicorn-6741.exe
316	420664f5321b3f6690dba19987efc4ec7a127e0508cce4f9e2d121d1ddab4886N.exe
316	420664f5321b3f6690dba19987efc4ec7a127e0508cce4f9e2d121d1ddab4886N.exe
2868	Unicorn-6741.exe
2472	Unicorn-27131.exe
2472	Unicorn-27131.exe
2620	Unicorn-11380.exe
2620	Unicorn-11380.exe
2004	Unicorn-1977.exe
2004	Unicorn-1977.exe
2844	Unicorn-47914.exe
2844	Unicorn-47914.exe
316	420664f5321b3f6690dba19987efc4ec7a127e0508cce4f9e2d121d1ddab4886N.exe
316	420664f5321b3f6690dba19987efc4ec7a127e0508cce4f9e2d121d1ddab4886N.exe
2320	Unicorn-13186.exe
2320	Unicorn-13186.exe
2848	Unicorn-16947.exe
2584	Unicorn-61649.exe
2848	Unicorn-16947.exe
2584	Unicorn-61649.exe
1952	Unicorn-10410.exe
1952	Unicorn-10410.exe
1708	Unicorn-30805.exe
2524	Unicorn-20203.exe
1708	Unicorn-30805.exe
2524	Unicorn-20203.exe
2868	Unicorn-6741.exe
2648	Unicorn-18963.exe
2868	Unicorn-6741.exe
2648	Unicorn-18963.exe
2712	Unicorn-23078.exe
2712	Unicorn-23078.exe
2256	Unicorn-33156.exe
2256	Unicorn-33156.exe
2472	Unicorn-27131.exe
2472	Unicorn-27131.exe
908	Unicorn-11946.exe
908	Unicorn-11946.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1844	1264	WerFault.exe	104

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6661.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11582.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8657.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5304.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5361.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26545.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21352.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53994.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14090.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63027.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27663.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26570.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43265.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61873.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5981.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46336.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64603.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64290.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41535.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5932.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41013.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31337.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65160.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10232.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2400.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5044.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2017.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49592.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13415.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22671.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2224.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31316.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-489.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5503.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5932.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16242.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17757.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31424.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17461.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19411.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45267.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50187.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14555.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29389.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62725.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29288.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60175.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64030.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6661.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54859.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6000.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60499.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58463.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47387.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65414.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21839.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64106.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14025.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17461.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60292.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31337.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60094.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35405.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14090.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
316	420664f5321b3f6690dba19987efc4ec7a127e0508cce4f9e2d121d1ddab4886N.exe
2524	Unicorn-20203.exe
1708	Unicorn-30805.exe
2320	Unicorn-13186.exe
2868	Unicorn-6741.exe
2712	Unicorn-23078.exe
2620	Unicorn-11380.exe
2848	Unicorn-16947.exe
2472	Unicorn-27131.exe
2648	Unicorn-18963.exe
2364	Unicorn-2242.exe
1244	Unicorn-31769.exe
2004	Unicorn-1977.exe
2844	Unicorn-47914.exe
2584	Unicorn-61649.exe
1952	Unicorn-10410.exe
2256	Unicorn-33156.exe
908	Unicorn-11946.exe
2236	Unicorn-24028.exe
2444	Unicorn-40364.exe
2116	Unicorn-64106.exe
1684	Unicorn-20009.exe
1380	Unicorn-50644.exe
1892	Unicorn-5205.exe
1812	Unicorn-58812.exe
1508	Unicorn-50187.exe
1340	Unicorn-44322.exe
1576	Unicorn-29517.exe
688	Unicorn-49383.exe
2152	Unicorn-31162.exe
1556	Unicorn-60094.exe
2420	Unicorn-23700.exe
2676	Unicorn-34246.exe
2172	Unicorn-60487.exe
2372	Unicorn-62896.exe
2204	Unicorn-52201.exe
2928	Unicorn-48672.exe
1356	Unicorn-60177.exe
2872	Unicorn-16383.exe
2908	Unicorn-52393.exe
2332	Unicorn-32527.exe
2668	Unicorn-43265.exe
2628	Unicorn-23399.exe
988	Unicorn-13415.exe
3052	Unicorn-26472.exe
1636	Unicorn-12246.exe
288	Unicorn-26545.exe
2888	Unicorn-26545.exe
828	Unicorn-34327.exe
2024	Unicorn-54640.exe
548	Unicorn-46472.exe
3028	Unicorn-39927.exe
1836	Unicorn-28718.exe
1644	Unicorn-17757.exe
1664	Unicorn-32056.exe
768	Unicorn-7173.exe
2892	Unicorn-15838.exe
2924	Unicorn-16104.exe
1140	Unicorn-50814.exe
2392	Unicorn-20619.exe
2180	Unicorn-65330.exe
832	Unicorn-60499.exe
1324	Unicorn-21504.exe
940	Unicorn-11874.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 316 wrote to memory of 2524	316	420664f5321b3f6690dba19987efc4ec7a127e0508cce4f9e2d121d1ddab4886N.exe	30
PID 316 wrote to memory of 2524	316	420664f5321b3f6690dba19987efc4ec7a127e0508cce4f9e2d121d1ddab4886N.exe	30
PID 316 wrote to memory of 2524	316	420664f5321b3f6690dba19987efc4ec7a127e0508cce4f9e2d121d1ddab4886N.exe	30
PID 316 wrote to memory of 2524	316	420664f5321b3f6690dba19987efc4ec7a127e0508cce4f9e2d121d1ddab4886N.exe	30
PID 2524 wrote to memory of 1708	2524	Unicorn-20203.exe	31
PID 2524 wrote to memory of 1708	2524	Unicorn-20203.exe	31
PID 2524 wrote to memory of 1708	2524	Unicorn-20203.exe	31
PID 2524 wrote to memory of 1708	2524	Unicorn-20203.exe	31
PID 316 wrote to memory of 2320	316	420664f5321b3f6690dba19987efc4ec7a127e0508cce4f9e2d121d1ddab4886N.exe	32
PID 316 wrote to memory of 2320	316	420664f5321b3f6690dba19987efc4ec7a127e0508cce4f9e2d121d1ddab4886N.exe	32
PID 316 wrote to memory of 2320	316	420664f5321b3f6690dba19987efc4ec7a127e0508cce4f9e2d121d1ddab4886N.exe	32
PID 316 wrote to memory of 2320	316	420664f5321b3f6690dba19987efc4ec7a127e0508cce4f9e2d121d1ddab4886N.exe	32
PID 2320 wrote to memory of 2868	2320	Unicorn-13186.exe	33
PID 2320 wrote to memory of 2868	2320	Unicorn-13186.exe	33
PID 2320 wrote to memory of 2868	2320	Unicorn-13186.exe	33
PID 2320 wrote to memory of 2868	2320	Unicorn-13186.exe	33
PID 316 wrote to memory of 2848	316	420664f5321b3f6690dba19987efc4ec7a127e0508cce4f9e2d121d1ddab4886N.exe	34
PID 316 wrote to memory of 2848	316	420664f5321b3f6690dba19987efc4ec7a127e0508cce4f9e2d121d1ddab4886N.exe	34
PID 316 wrote to memory of 2848	316	420664f5321b3f6690dba19987efc4ec7a127e0508cce4f9e2d121d1ddab4886N.exe	34
PID 316 wrote to memory of 2848	316	420664f5321b3f6690dba19987efc4ec7a127e0508cce4f9e2d121d1ddab4886N.exe	34
PID 2524 wrote to memory of 2620	2524	Unicorn-20203.exe	36
PID 2524 wrote to memory of 2620	2524	Unicorn-20203.exe	36
PID 2524 wrote to memory of 2620	2524	Unicorn-20203.exe	36
PID 2524 wrote to memory of 2620	2524	Unicorn-20203.exe	36
PID 1708 wrote to memory of 2712	1708	Unicorn-30805.exe	35
PID 1708 wrote to memory of 2712	1708	Unicorn-30805.exe	35
PID 1708 wrote to memory of 2712	1708	Unicorn-30805.exe	35
PID 1708 wrote to memory of 2712	1708	Unicorn-30805.exe	35
PID 2620 wrote to memory of 2472	2620	Unicorn-11380.exe	37
PID 2620 wrote to memory of 2472	2620	Unicorn-11380.exe	37
PID 2620 wrote to memory of 2472	2620	Unicorn-11380.exe	37
PID 2712 wrote to memory of 2648	2712	Unicorn-23078.exe	38
PID 2620 wrote to memory of 2472	2620	Unicorn-11380.exe	37
PID 2712 wrote to memory of 2648	2712	Unicorn-23078.exe	38
PID 2712 wrote to memory of 2648	2712	Unicorn-23078.exe	38
PID 2712 wrote to memory of 2648	2712	Unicorn-23078.exe	38
PID 1708 wrote to memory of 1244	1708	Unicorn-30805.exe	39
PID 1708 wrote to memory of 1244	1708	Unicorn-30805.exe	39
PID 1708 wrote to memory of 1244	1708	Unicorn-30805.exe	39
PID 1708 wrote to memory of 1244	1708	Unicorn-30805.exe	39
PID 2320 wrote to memory of 2844	2320	Unicorn-13186.exe	40
PID 2320 wrote to memory of 2844	2320	Unicorn-13186.exe	40
PID 2320 wrote to memory of 2844	2320	Unicorn-13186.exe	40
PID 2320 wrote to memory of 2844	2320	Unicorn-13186.exe	40
PID 2524 wrote to memory of 2584	2524	Unicorn-20203.exe	41
PID 2524 wrote to memory of 2584	2524	Unicorn-20203.exe	41
PID 2524 wrote to memory of 2584	2524	Unicorn-20203.exe	41
PID 2524 wrote to memory of 2584	2524	Unicorn-20203.exe	41
PID 2848 wrote to memory of 2364	2848	Unicorn-16947.exe	42
PID 2848 wrote to memory of 2364	2848	Unicorn-16947.exe	42
PID 2848 wrote to memory of 2364	2848	Unicorn-16947.exe	42
PID 2848 wrote to memory of 2364	2848	Unicorn-16947.exe	42
PID 316 wrote to memory of 2004	316	420664f5321b3f6690dba19987efc4ec7a127e0508cce4f9e2d121d1ddab4886N.exe	44
PID 316 wrote to memory of 2004	316	420664f5321b3f6690dba19987efc4ec7a127e0508cce4f9e2d121d1ddab4886N.exe	44
PID 316 wrote to memory of 2004	316	420664f5321b3f6690dba19987efc4ec7a127e0508cce4f9e2d121d1ddab4886N.exe	44
PID 316 wrote to memory of 2004	316	420664f5321b3f6690dba19987efc4ec7a127e0508cce4f9e2d121d1ddab4886N.exe	44
PID 2868 wrote to memory of 1952	2868	Unicorn-6741.exe	43
PID 2868 wrote to memory of 1952	2868	Unicorn-6741.exe	43
PID 2868 wrote to memory of 1952	2868	Unicorn-6741.exe	43
PID 2868 wrote to memory of 1952	2868	Unicorn-6741.exe	43
PID 2472 wrote to memory of 2256	2472	Unicorn-27131.exe	45
PID 2472 wrote to memory of 2256	2472	Unicorn-27131.exe	45
PID 2472 wrote to memory of 2256	2472	Unicorn-27131.exe	45
PID 2472 wrote to memory of 2256	2472	Unicorn-27131.exe	45

C:\Users\Admin\AppData\Local\Temp\420664f5321b3f6690dba19987efc4ec7a127e0508cce4f9e2d121d1ddab4886N.exe
"C:\Users\Admin\AppData\Local\Temp\420664f5321b3f6690dba19987efc4ec7a127e0508cce4f9e2d121d1ddab4886N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:316
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20203.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20203.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30805.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30805.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23078.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23078.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18963.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49383.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46472.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43211.exe
        8⤵
        
        PID:2076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17461.exe
        8⤵
        
        PID:3396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14090.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13334.exe
        8⤵
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5503.exe
        8⤵
        
        PID:5204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64570.exe
        7⤵
        
        PID:1660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26043.exe
        7⤵
        
        PID:3512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19955.exe
        7⤵
        
        PID:4976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62614.exe
        7⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2429.exe
        7⤵
        
        PID:6632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28718.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26706.exe
        7⤵
        
        PID:2664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41535.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58463.exe
        8⤵
        
        PID:3616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9333.exe
        8⤵
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21839.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21669.exe
        7⤵
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6661.exe
        7⤵
        
        PID:3452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-668.exe
        7⤵
        
        PID:4128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18939.exe
        7⤵
        
        PID:6688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44120.exe
        6⤵
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29071.exe
        7⤵
        
        PID:4268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40713.exe
        7⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8303.exe
        7⤵
        
        PID:6000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53792.exe
        6⤵
        
        PID:3708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34857.exe
        6⤵
        
        PID:3992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62869.exe
        6⤵
        
        PID:6048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52924.exe
        6⤵
        
        PID:6972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31162.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54640.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48914.exe
        7⤵
        
        PID:2604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50295.exe
        7⤵
        
        PID:3092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9333.exe
        7⤵
        
        PID:4276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61803.exe
        7⤵
        
        PID:5428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27896.exe
        6⤵
        
        PID:2080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64030.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14522.exe
        6⤵
        
        PID:4692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30839.exe
        6⤵
        
        PID:5412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10597.exe
        6⤵
        
        PID:6624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17757.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10154.exe
        6⤵
        
        PID:1332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17461.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14090.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13334.exe
        6⤵
        
        PID:5688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61803.exe
        6⤵
        
        PID:5144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20745.exe
        5⤵
        
        PID:2036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28396.exe
        5⤵
        
        PID:3344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60292.exe
        5⤵
        
        PID:4896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62568.exe
        5⤵
        
        PID:5564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40802.exe
        5⤵
        
        PID:5208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31769.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31769.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48672.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34490.exe
        6⤵
        
        PID:1468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49709.exe
        7⤵
        
        PID:4572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54449.exe
        7⤵
        
        PID:5304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14168.exe
        7⤵
        
        PID:5424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55878.exe
        6⤵
        
        PID:3376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30700.exe
        6⤵
        
        PID:4164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25791.exe
        6⤵
        
        PID:6092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-797.exe
        6⤵
        
        PID:6616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20575.exe
        5⤵
        
        PID:1936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54062.exe
        6⤵
        
        PID:3436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7617.exe
        6⤵
        
        PID:3968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8657.exe
        6⤵
        
        PID:4648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31337.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27132.exe
        6⤵
        
        PID:6896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29288.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51194.exe
        5⤵
        
        PID:3212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28730.exe
        5⤵
        
        PID:4112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62333.exe
        5⤵
        
        PID:6168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44322.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44322.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37509.exe
        5⤵
        
        PID:1608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27483.exe
        6⤵
        
        PID:3464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3090.exe
        6⤵
        
        PID:4808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33639.exe
        6⤵
        
        PID:5616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13723.exe
        6⤵
        
        PID:6952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5044.exe
        5⤵
        
        PID:3276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60292.exe
        5⤵
        
        PID:4848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5199.exe
        5⤵
        
        PID:5632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41871.exe
        5⤵
        
        PID:5640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15838.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45515.exe
        5⤵
        
        PID:2056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17461.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14090.exe
        5⤵
        
        PID:4920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13334.exe
        5⤵
        
        PID:5680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61803.exe
        5⤵
        
        PID:5752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47576.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47576.exe
      4⤵
      PID:2740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11582.exe
        5⤵
        
        PID:3136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65160.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35798.exe
        5⤵
        
        PID:6680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11861.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11861.exe
      4⤵
      PID:3392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11820.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11820.exe
      4⤵
      PID:4784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49205.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49205.exe
      4⤵
      PID:5668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44704.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44704.exe
      4⤵
      PID:5172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11380.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11380.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27131.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27131.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33156.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60094.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20619.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49703.exe
        8⤵
        
        PID:448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58463.exe
        8⤵
        
        PID:3716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8657.exe
        8⤵
        
        PID:4604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31337.exe
        8⤵
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27132.exe
        8⤵
        
        PID:6880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31782.exe
        7⤵
        
        PID:3608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59859.exe
        7⤵
        
        PID:3180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45510.exe
        7⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46336.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65330.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25487.exe
        7⤵
        
        PID:2912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4358.exe
        7⤵
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5473.exe
        7⤵
        
        PID:4248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21896.exe
        7⤵
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27663.exe
        7⤵
        
        PID:6768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37509.exe
        6⤵
        
        PID:1792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59439.exe
        7⤵
        
        PID:3168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64834.exe
        7⤵
        
        PID:2948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8303.exe
        7⤵
        
        PID:5992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51649.exe
        6⤵
        
        PID:4084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11827.exe
        6⤵
        
        PID:4512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21098.exe
        7⤵
        
        PID:4884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42934.exe
        7⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8303.exe
        7⤵
        
        PID:5252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20136.exe
        6⤵
        
        PID:5028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63144.exe
        6⤵
        
        PID:5952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63501.exe
        6⤵
        
        PID:6544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23700.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60499.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49703.exe
        7⤵
        
        PID:2720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58463.exe
        7⤵
        
        PID:3720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16825.exe
        7⤵
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18935.exe
        7⤵
        
        PID:924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5932.exe
        7⤵
        
        PID:6460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23422.exe
        6⤵
        
        PID:3680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60644.exe
        6⤵
        
        PID:4556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43281.exe
        6⤵
        
        PID:5448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6033.exe
        6⤵
        
        PID:5760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21504.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52853.exe
        6⤵
        
        PID:2140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58463.exe
        6⤵
        
        PID:3628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9333.exe
        6⤵
        
        PID:1268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1874.exe
        6⤵
        
        PID:6660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41270.exe
        5⤵
        
        PID:2540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3861.exe
        5⤵
        
        PID:3404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54859.exe
        5⤵
        
        PID:4532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63472.exe
        5⤵
        
        PID:6104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61669.exe
        5⤵
        
        PID:6388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11946.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11946.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34246.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11874.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60175.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7617.exe
        7⤵
        
        PID:3588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8657.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31337.exe
        7⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27132.exe
        7⤵
        
        PID:6872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21669.exe
        6⤵
        
        PID:2224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6661.exe
        6⤵
        
        PID:3568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47387.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62936.exe
        6⤵
        
        PID:5188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10597.exe
        6⤵
        
        PID:6736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41017.exe
        5⤵
        Executes dropped EXE
        
        PID:2900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36517.exe
        6⤵
        
        PID:1260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58463.exe
        6⤵
        
        PID:3356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8657.exe
        6⤵
        
        PID:4508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18935.exe
        6⤵
        
        PID:6016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21391.exe
        6⤵
        
        PID:6312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63635.exe
        5⤵
        
        PID:2728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12526.exe
        5⤵
        
        PID:3240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5857.exe
        5⤵
        
        PID:4448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19465.exe
        5⤵
        
        PID:2508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1467.exe
        5⤵
        
        PID:6400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60487.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60487.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11682.exe
        5⤵
        
        PID:2528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12012.exe
        6⤵
        
        PID:2976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58463.exe
        6⤵
        
        PID:3872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16825.exe
        6⤵
        
        PID:5056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31337.exe
        6⤵
        
        PID:5352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27132.exe
        6⤵
        
        PID:6792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58068.exe
        5⤵
        
        PID:2456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6661.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22691.exe
        5⤵
        
        PID:5024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22671.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10597.exe
        5⤵
        
        PID:6824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5361.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5361.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45784.exe
        5⤵
        
        PID:4072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20492.exe
        5⤵
        
        PID:4484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51649.exe
        5⤵
        
        PID:5272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54505.exe
        5⤵
        
        PID:5432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40773.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40773.exe
      4⤵
      PID:1804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52863.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52863.exe
      4⤵
      PID:3476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45204.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45204.exe
      4⤵
      PID:4236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61041.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61041.exe
      4⤵
      PID:6356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61649.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61649.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50644.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50644.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26545.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8065.exe
        6⤵
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28733.exe
        7⤵
        
        PID:2644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58463.exe
        7⤵
        
        PID:3732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9333.exe
        7⤵
        
        PID:4748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26570.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24819.exe
        6⤵
        
        PID:888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6661.exe
        6⤵
        
        PID:3552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-668.exe
        6⤵
        
        PID:4264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46640.exe
        6⤵
        
        PID:7076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14624.exe
        5⤵
        
        PID:2836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52853.exe
        6⤵
        
        PID:2460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58463.exe
        6⤵
        
        PID:3884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-489.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31337.exe
        6⤵
        
        PID:5292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62725.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29288.exe
        5⤵
        
        PID:3648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34857.exe
        5⤵
        
        PID:4028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48439.exe
        5⤵
        
        PID:4216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63402.exe
        5⤵
        
        PID:5408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39927.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39927.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43639.exe
        5⤵
        
        PID:292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31618.exe
        6⤵
        
        PID:1860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50295.exe
        6⤵
        
        PID:3112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8657.exe
        6⤵
        
        PID:4548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18935.exe
        6⤵
        
        PID:6068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5932.exe
        6⤵
        
        PID:6412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11752.exe
        5⤵
        
        PID:2920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64030.exe
        5⤵
        
        PID:4092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14522.exe
        5⤵
        
        PID:4696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2400.exe
        5⤵
        
        PID:6136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22997.exe
        5⤵
        
        PID:6436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37509.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37509.exe
      4⤵
      PID:1948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51281.exe
        5⤵
        
        PID:4008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44123.exe
        5⤵
        
        PID:4376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25471.exe
        5⤵
        
        PID:5268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35798.exe
        5⤵
        
        PID:6744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5044.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5044.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60292.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60292.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29704.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29704.exe
      4⤵
      PID:5792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40802.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40802.exe
      4⤵
      PID:6184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50187.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50187.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32056.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32056.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61991.exe
        5⤵
        
        PID:2852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20221.exe
        6⤵
        
        PID:4864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34574.exe
        6⤵
        
        PID:5848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64603.exe
        6⤵
        
        PID:6260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26043.exe
        5⤵
        
        PID:3500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31316.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5981.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29932.exe
        6⤵
        
        PID:6640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19955.exe
        5⤵
        
        PID:4936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45510.exe
        5⤵
        
        PID:5836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45267.exe
        5⤵
        
        PID:6252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23773.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23773.exe
      4⤵
      PID:656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59506.exe
        5⤵
        
        PID:3224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-355.exe
        5⤵
        
        PID:4872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65414.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35798.exe
        5⤵
        
        PID:6840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45976.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45976.exe
      4⤵
      PID:3936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2189.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2189.exe
      4⤵
      PID:4132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10232.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10232.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54505.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54505.exe
      4⤵
      PID:6120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7173.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7173.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16242.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16242.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50295.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50295.exe
      4⤵
      PID:3084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8657.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8657.exe
      4⤵
      PID:4476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18935.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18935.exe
      4⤵
      PID:932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5932.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5932.exe
      4⤵
      PID:6492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31424.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31424.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61760.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61760.exe
    3⤵
    PID:2812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50393.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50393.exe
    3⤵
    PID:5008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4504.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4504.exe
    3⤵
    PID:5552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4997.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4997.exe
    3⤵
    PID:6596
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13186.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13186.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6741.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6741.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10410.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10410.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58812.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52393.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46231.exe
        7⤵
        
        PID:2132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19234.exe
        8⤵
        
        PID:4172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49592.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13723.exe
        8⤵
        
        PID:6920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26043.exe
        7⤵
        
        PID:3468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30169.exe
        7⤵
        
        PID:4196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30256.exe
        7⤵
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27663.exe
        7⤵
        
        PID:6776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23773.exe
        6⤵
        
        PID:1080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18183.exe
        7⤵
        
        PID:3184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7617.exe
        7⤵
        
        PID:3524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20492.exe
        7⤵
        
        PID:4492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41221.exe
        7⤵
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27663.exe
        7⤵
        
        PID:6784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13709.exe
        6⤵
        
        PID:3268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11290.exe
        6⤵
        
        PID:4856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37334.exe
        6⤵
        
        PID:5544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6993.exe
        6⤵
        
        PID:5248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23399.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43639.exe
        6⤵
        
        PID:872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10974.exe
        7⤵
        
        PID:3096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7617.exe
        7⤵
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8657.exe
        7⤵
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31337.exe
        7⤵
        
        PID:5396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27132.exe
        7⤵
        
        PID:6864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14845.exe
        6⤵
        
        PID:3408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21352.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14522.exe
        6⤵
        
        PID:4704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2400.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22997.exe
        6⤵
        
        PID:6440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37509.exe
        5⤵
        
        PID:1308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44831.exe
        6⤵
        
        PID:4348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59271.exe
        6⤵
        
        PID:5736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64603.exe
        6⤵
        
        PID:6208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51841.exe
        5⤵
        
        PID:3960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59061.exe
        5⤵
        
        PID:4180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59234.exe
        5⤵
        
        PID:4192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62333.exe
        5⤵
        
        PID:6176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29517.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29517.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13415.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59526.exe
        6⤵
        
        PID:896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3861.exe
        6⤵
        
        PID:3444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63027.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23201.exe
        6⤵
        
        PID:5224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52924.exe
        6⤵
        
        PID:6936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23773.exe
        5⤵
        
        PID:2252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41535.exe
        6⤵
        
        PID:1920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58463.exe
        6⤵
        
        PID:2548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8657.exe
        6⤵
        
        PID:4480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31337.exe
        6⤵
        
        PID:5296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27132.exe
        6⤵
        
        PID:6712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35405.exe
        5⤵
        
        PID:1192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12526.exe
        5⤵
        
        PID:3320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5857.exe
        5⤵
        
        PID:4676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19465.exe
        5⤵
        
        PID:5128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38114.exe
        5⤵
        
        PID:7116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12246.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12246.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45655.exe
        5⤵
        
        PID:2600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36577.exe
        6⤵
        
        PID:6908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31196.exe
        5⤵
        
        PID:3372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19955.exe
        5⤵
        
        PID:4952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4669.exe
        5⤵
        
        PID:5704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43636.exe
        5⤵
        
        PID:6216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43374.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43374.exe
      4⤵
      PID:1856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52007.exe
        5⤵
        
        PID:1036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37658.exe
        5⤵
        
        PID:3176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8103.exe
        5⤵
        
        PID:4208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38752.exe
        5⤵
        
        PID:6472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9636.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9636.exe
      4⤵
      PID:3332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2017.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2017.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14555.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14555.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1671.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1671.exe
      4⤵
      PID:5572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-797.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-797.exe
      4⤵
      PID:6816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47914.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47914.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40364.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40364.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60177.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41013.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11436.exe
        7⤵
        
        PID:1160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58463.exe
        7⤵
        
        PID:2468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-489.exe
        7⤵
        
        PID:4404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39505.exe
        7⤵
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27132.exe
        7⤵
        
        PID:6668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29837.exe
        6⤵
        
        PID:2840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6661.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14522.exe
        6⤵
        
        PID:4720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2400.exe
        6⤵
        
        PID:6076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22997.exe
        6⤵
        
        PID:6456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23773.exe
        5⤵
        
        PID:2328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41535.exe
        6⤵
        
        PID:2556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58463.exe
        6⤵
        
        PID:2016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8657.exe
        6⤵
        
        PID:4524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31337.exe
        6⤵
        
        PID:5256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27132.exe
        6⤵
        
        PID:6752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35405.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12526.exe
        5⤵
        
        PID:3312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5857.exe
        5⤵
        
        PID:4656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14304.exe
        5⤵
        
        PID:5368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58259.exe
        5⤵
        
        PID:6960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32527.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32527.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40354.exe
        5⤵
        
        PID:2816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43170.exe
        6⤵
        
        PID:3920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48126.exe
        6⤵
        
        PID:4140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13032.exe
        6⤵
        
        PID:5084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14168.exe
        6⤵
        
        PID:5180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48286.exe
        5⤵
        
        PID:3140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60644.exe
        5⤵
        
        PID:4580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58479.exe
        5⤵
        
        PID:5236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6132.exe
        5⤵
        
        PID:6848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34799.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34799.exe
      4⤵
      PID:1264
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1264 -s 188
        5⤵
        Program crash
        
        PID:1844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59718.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59718.exe
      4⤵
      PID:3128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18552.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18552.exe
      4⤵
      PID:3204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54859.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54859.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23201.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23201.exe
      4⤵
      PID:5316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6132.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6132.exe
      4⤵
      PID:6724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20009.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20009.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43265.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43265.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43639.exe
        5⤵
        
        PID:1820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60124.exe
        6⤵
        
        PID:3532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45872.exe
        6⤵
        
        PID:5116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48298.exe
        6⤵
        
        PID:7108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64913.exe
        5⤵
        
        PID:4036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61861.exe
        5⤵
        
        PID:4148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35234.exe
        5⤵
        
        PID:5148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61803.exe
        5⤵
        
        PID:6244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23773.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23773.exe
      4⤵
      PID:1740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39678.exe
        5⤵
        
        PID:4380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2224.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22389.exe
        5⤵
        
        PID:6984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13709.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13709.exe
      4⤵
      PID:3264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11290.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11290.exe
      4⤵
      PID:4840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28974.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28974.exe
      4⤵
      PID:5864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62333.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62333.exe
      4⤵
      PID:6236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26472.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26472.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61991.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61991.exe
      4⤵
      PID:2708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45129.exe
        5⤵
        
        PID:7128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31196.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31196.exe
      4⤵
      PID:3364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19955.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19955.exe
      4⤵
      PID:4944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4669.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4669.exe
      4⤵
      PID:5696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45267.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45267.exe
      4⤵
      PID:5232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34708.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34708.exe
    3⤵
    PID:1492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41535.exe
      4⤵
      PID:2716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58463.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58463.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8657.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8657.exe
      4⤵
      PID:4632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18935.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18935.exe
      4⤵
      PID:6012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5932.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5932.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16069.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16069.exe
    3⤵
    PID:2536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4391.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4391.exe
    3⤵
    PID:3248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58561.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58561.exe
    3⤵
    PID:4796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61873.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61873.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29389.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29389.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6932
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16947.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16947.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2242.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2242.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62896.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62896.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21771.exe
        5⤵
        
        PID:2884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9687.exe
        6⤵
        
        PID:3672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3772.exe
        6⤵
        
        PID:4616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37533.exe
        6⤵
        
        PID:5440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54505.exe
        6⤵
        
        PID:5976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39733.exe
        5⤵
        
        PID:2860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39334.exe
        5⤵
        
        PID:3296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-668.exe
        5⤵
        
        PID:4240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54505.exe
        5⤵
        
        PID:5496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57249.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57249.exe
      4⤵
      PID:2432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64290.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50295.exe
        5⤵
        
        PID:3116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8657.exe
        5⤵
        
        PID:4668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18935.exe
        5⤵
        
        PID:6020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5932.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4648.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4648.exe
      4⤵
      PID:2512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61230.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61230.exe
      4⤵
      PID:3152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54859.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54859.exe
      4⤵
      PID:4624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31370.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31370.exe
      4⤵
      PID:5516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52924.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52924.exe
      4⤵
      PID:6968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5205.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5205.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16104.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16104.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11436.exe
        5⤵
        
        PID:1700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58463.exe
        5⤵
        
        PID:3632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8657.exe
        5⤵
        
        PID:4596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31337.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27132.exe
        5⤵
        
        PID:6888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23422.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23422.exe
      4⤵
      PID:3692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43523.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43523.exe
      4⤵
      PID:4016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48639.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48639.exe
      4⤵
      PID:5076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45267.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45267.exe
      4⤵
      PID:6160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50814.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50814.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45655.exe
      4⤵
      PID:2820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59439.exe
        5⤵
        
        PID:3232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64834.exe
        5⤵
        
        PID:2992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64603.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19411.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19411.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19955.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19955.exe
      4⤵
      PID:4968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45510.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45510.exe
      4⤵
      PID:5876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45267.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45267.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43374.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43374.exe
    3⤵
    PID:1300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11582.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11582.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65160.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65160.exe
      4⤵
      PID:5968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35798.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35798.exe
      4⤵
      PID:6856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43176.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43176.exe
    3⤵
    PID:3908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42525.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42525.exe
    3⤵
    PID:4156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18930.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18930.exe
    3⤵
    PID:2112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41871.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41871.exe
    3⤵
    PID:5604
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1977.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1977.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24028.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24028.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52201.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52201.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63379.exe
        5⤵
        
        PID:1568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49703.exe
        6⤵
        
        PID:1548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58463.exe
        6⤵
        
        PID:836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29619.exe
        6⤵
        
        PID:2408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61803.exe
        6⤵
        
        PID:6152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23422.exe
        5⤵
        
        PID:3700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60644.exe
        5⤵
        
        PID:4564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35113.exe
        5⤵
        
        PID:5320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62333.exe
        5⤵
        
        PID:6268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13664.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13664.exe
      4⤵
      PID:2396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9687.exe
        5⤵
        
        PID:3664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53994.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6256.exe
        5⤵
        
        PID:6124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27132.exe
        5⤵
        
        PID:6704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43573.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43573.exe
      4⤵
      PID:3068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12526.exe
      4⤵
      PID:3328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14025.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14025.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6136.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6136.exe
      4⤵
      PID:5608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27663.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27663.exe
      4⤵
      PID:6808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16383.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16383.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13986.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13986.exe
      4⤵
      PID:2776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60175.exe
        5⤵
        
        PID:544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3772.exe
        5⤵
        
        PID:4608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45702.exe
        5⤵
        
        PID:5484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54505.exe
        5⤵
        
        PID:6088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40309.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40309.exe
      4⤵
      PID:2520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15213.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15213.exe
      4⤵
      PID:3944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-668.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-668.exe
      4⤵
      PID:4224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5304.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5304.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34223.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34223.exe
    3⤵
    PID:2452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1986.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1986.exe
      4⤵
      PID:2276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38732.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38732.exe
      4⤵
      PID:3560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14090.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14090.exe
      4⤵
      PID:4960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54175.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54175.exe
      4⤵
      PID:5884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62872.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62872.exe
      4⤵
      PID:5336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15592.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15592.exe
    3⤵
    PID:344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23243.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23243.exe
    3⤵
    PID:3492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60292.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60292.exe
    3⤵
    PID:4912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62568.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62568.exe
    3⤵
    PID:5576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35306.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35306.exe
    3⤵
    PID:7140
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64106.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64106.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26545.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26545.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43639.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43639.exe
      4⤵
      PID:1732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1229.exe
        5⤵
        
        PID:3600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-355.exe
        5⤵
        
        PID:4812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7469.exe
        5⤵
        
        PID:5644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6000.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32240.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32240.exe
      4⤵
      PID:3928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1774.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1774.exe
      4⤵
      PID:4712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45702.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45702.exe
      4⤵
      PID:5508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54505.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54505.exe
      4⤵
      PID:5176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23773.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23773.exe
    3⤵
    PID:604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49703.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49703.exe
      4⤵
      PID:2660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58463.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58463.exe
      4⤵
      PID:348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29619.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29619.exe
      4⤵
      PID:3056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5503.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53661.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53661.exe
    3⤵
    PID:580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12526.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12526.exe
    3⤵
    PID:3304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5857.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5857.exe
    3⤵
    PID:4452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14304.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14304.exe
    3⤵
    PID:5436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27663.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27663.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6832
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34327.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34327.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2606.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2606.exe
    3⤵
    PID:2268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59439.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59439.exe
      4⤵
      PID:3484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7465.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7465.exe
      4⤵
      PID:5096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8303.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8303.exe
      4⤵
      PID:1956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40216.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40216.exe
    3⤵
    PID:3076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14627.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14627.exe
    3⤵
    PID:4500
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54367.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54367.exe
    3⤵
    PID:5472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62872.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62872.exe
    3⤵
    PID:5460
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35239.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35239.exe
  2⤵
  PID:1760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41535.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41535.exe
    3⤵
    PID:1480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58463.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58463.exe
    3⤵
    PID:3584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9333.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9333.exe
    3⤵
    PID:4292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21839.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21839.exe
    3⤵
    PID:6336
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30244.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30244.exe
  2⤵
  PID:1292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47076.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47076.exe
    3⤵
    PID:4284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19904.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19904.exe
    3⤵
    PID:5656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29932.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29932.exe
    3⤵
    PID:6800
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57753.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57753.exe
  2⤵
  PID:3200
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57427.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57427.exe
  2⤵
  PID:4764
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46505.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46505.exe
  2⤵
  PID:5624
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24597.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24597.exe
  2⤵
  PID:6648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-2242.exe

Filesize
468KB

MD5
435c031e65dde9e3c90af104b235cb0e

SHA1
400fd949e69abfc0a1729e0a8c6d64fe2ea57c59

SHA256
f9c87d9b9648e538ac861c3107723dd86e2430fa6d92a488a3cf96b7205b0b0b

SHA512
b2838ab41e27a312ac3bb42343c6abc0fdd812d5a23955c53ebfd8aee6e224406804a302ffa8ec30b0a7e16868a1f8a365e16dc1122394c3d74d54ac4ee15fd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30805.exe

Filesize
468KB

MD5
4056a2a74d02f98a4013d64d1219d1c6

SHA1
1bd364282007e064e59aea1e10f13fa9ec947000

SHA256
0b88e4257074114b0a055722be22aa046c18157cd6548a645a367982a2be9d7f

SHA512
c5b36a821985f00093ae3c5fa8f6b3e13a43303d372b25691373feaabc74bbf80286105ddc5622ba296e031c71cd15750812a7daa643e22c4c4c0f62efffddab

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31769.exe

Filesize
468KB

MD5
e361a11ee3a7f445384b964b26f997bb

SHA1
099727fd6e9f2cc4e0dde0335e7987346069671f

SHA256
f47219e23edbe6d11ea5d61f6f8e867153088b1ab379d8ef97e76f21e8d86ce3

SHA512
f0c89cbbd36b46e1c1d5841f89beb1f5e52cee6a3ed06188c5fadadc5cdcf4f18731d7305cc477a68e605a1802e3933abb4a89eb3d8b54ef9d507d02c8a2f897

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39927.exe

Filesize
468KB

MD5
d37afaa315828625e1b61cf61b82c9d2

SHA1
a1beb8d7dced31c51d2f4f59dd55fc42d2961071

SHA256
ac88d18ee97304c6998f949aaa33e249fd82a3bab04ae417f367df3577ce5d33

SHA512
6b46f88da22214eb3a6f1b1d078dd543b97b0285ecd491ec2758083b7973112f5d09a3177f4c3b0b63317743baa666755da1267618a60333af58d9458cfc6e0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61649.exe

Filesize
468KB

MD5
5452f101814b49d224281d0009d349d3

SHA1
b172014028d2c0cfe0e989ce9a1d294c374f6945

SHA256
026551722eb99d6eb95b9c4ce2c691525fd59db431b95b5f7fed1fc861a5c4f0

SHA512
2be04c5d7d4219cf08d14242bcc68b319e08db1287470e1d5a0a58779183d59a94f321f0186db4ade42a6ed813976ba60b7b7e295d83d342ee99a49c82178377

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-10410.exe

Filesize
468KB

MD5
b08940150f22d26e10f9b1f5dfd6a7c3

SHA1
583d4bbacf7fe15256f9b70bd29cc449cde4dd76

SHA256
e807fd223532dcbdafddbc886d6d0c7dd316aeb235c6e9e329b876886c49e8e1

SHA512
dde48eeae5b3290caaa1b26de6feadc35116400437e370e90ac66cc6c19e8613664d9b6146565ceac873482c49dd3351abf20dc55319f317eca031f4761ff028

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-11380.exe

Filesize
468KB

MD5
5c2a68c89d74f1b2af9b6d49ea6e8d2d

SHA1
8801bfe8a7e96b3f27188e7f49b4dcc991efff99

SHA256
ff8dfaf872379199f75e359947ade8ca138c0bfe37b92ab42ea2c2fe9557c97c

SHA512
e4050aa1d085dd2fe6e44dda22cb8dba347f0bef2545a5aa33dd93c912e89ca631ada416089d5f5e4e0f189f7154ae007a64ad3460655c2f21bbf26e8045cd82

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-11946.exe

Filesize
468KB

MD5
7454b77f56da482df20f96d2bdc8ae49

SHA1
3aa8584f051bca7e07f35728064a6a323488b90e

SHA256
378680e9c170d77f23dcb6eb95559d9c5e4c65fd23a331825f80e3f955bd355d

SHA512
9f38b65523975319bb69648d7bd065e3386ea0e0d33c15877d43059bf38fc7a0a81e3b9daadf13046e97fc727dcedd27b6ccffb5ae8c07bff225e11bcd14a5a9

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-13186.exe

Filesize
468KB

MD5
bc23ba6c06420adfdd58a082368ab518

SHA1
f2d70d04e158befdcf41ea56ca1abc12d842c466

SHA256
5d0e6be4e060559c741ac67a48334c6bc80880b5ddf8ef0f2e2742f8f8dc7ca0

SHA512
d0f0cde97f9835eb73dfee0a7f2d9abed0602dbf7647d2942b3871e6bf9d950886a4a595fc8941cb3e3d45bb8accc56a67bbb022b34c13b497d55a657a5a9250

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-16947.exe

Filesize
468KB

MD5
e862c289d764a3dd4b712af90d3b3da0

SHA1
ac5ef09e526aeb7753928bb8f0861037cdf3739c

SHA256
9128a5eed0ba48bb69b9e149b93ce7b2e71234c9ef43bc08d44370df705271e7

SHA512
0fe8c2644801cde6f0eb4390f1247b1900144ffd62c9787b0293964647f936b9f1da95e6909021afcdf18b9a73bb6f4be4f25c7862cb8a38b4c5be4168f834ca

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-18963.exe

Filesize
468KB

MD5
70eb120cb6aff2ef2349488720243699

SHA1
b6054570ef275b5479652a49a7ec9e4ed4e524d7

SHA256
f1aa90dfc6a10575e16cb0760bf0dd3739daca12d9cc69b9f1db3890d8564697

SHA512
3090304b3c731983886fd2e7d398c9c5425a967b2bdcd3779b320f4a54545e6625b6ebfc469b0d7b7c0564787cefc5640518c438050d781dc70ad5245bb741a1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-1977.exe

Filesize
468KB

MD5
4bee506ce91697e2e83edabc6e5c363d

SHA1
8d8bb8cc9a043b552ab017970a124b86f9605d44

SHA256
6c68028edba32aae0f1120a012c4238bb8ee4eb9a7be541347e1c0d7b46c0e71

SHA512
a3f57a414b89cc9f2f1fe7cc914b99e24d9ca3aa2df1d4c00568c9b14935bf6a5e808f969759017a970f34a0783d09147e7dfee4aafb1434f9c92e621879706c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-20203.exe

Filesize
468KB

MD5
617b5edcbbaee046b628f696281c3d61

SHA1
2e6d31ffa736d7197aead34e4a6bdb8cf785cb70

SHA256
a289af98196b58e571e122cf7be45df2b2b3ef099c14f38e4af0077acc44c47d

SHA512
2fd1e9b6ae3a5bf54ea5a29bdf9e404a91df10eec925e8e75c9ca933a8395c419d95063f40275ef67a2cf10b4c5849c07ad5ec7352f79db77ccc528fca3f33bb

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-23078.exe

Filesize
468KB

MD5
3430f1417492e07099d552f1e19eb17a

SHA1
6cec6f24d5d2e547399e46835d335d8ddeedc9b6

SHA256
ba6521265f799d3f7fbab7384a3de4f50dd9e9034df1424fbd82458bd61c1afe

SHA512
171c0a286f88071cdf1fc098a3eb0d8859fe39ebb337f40ed8f909f7305279a5625a33bf164e86e323f96fd420a2a0d49f44ae8f6ee77f62491ea1d665301043

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-24028.exe

Filesize
468KB

MD5
a872deb9c60d9efbbf7af82f9f54ef6c

SHA1
afa421864728a611a01ce3c174d84349ef3989cd

SHA256
415eefc651c88b23c92a733cacee882833ea5199ff70c7fdd3bd5261ebff79fa

SHA512
ad3ccb916abc2130ba17d3f074d51a3125c64f13e763580962a7be5b4b1afae4f36e3868e883bd6ea9c4f2f34132f748e55f8eae2f8af257c9499026309a07a6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-27131.exe

Filesize
468KB

MD5
663093f6747155f3eaae8e3f0673a6b0

SHA1
d544594b31fb2e0b009f1f575c6c9b1e78882f66

SHA256
38e6954c519de944c4949b42fe6df3b60fd03f6bbc211e9256c0697cf7b1b8f7

SHA512
76ab7a525b4b2e143a274019f6f86622e405107f189a87ba90ab9e0c36ba1a6656b5aed69a7f7021d7292bd1a17d723bd5f25488326cf77bd0c28e840b3738f1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-33156.exe

Filesize
468KB

MD5
dcb62ab6f5ed03a640b823e4597c86a3

SHA1
d9d3d02719ff8b33fad87e3421eea52926ba412f

SHA256
01c76e40c461d56ff6d8d5bca803ffda994827b7a4aa29dd246972768d05d805

SHA512
fafb641f20aa857b6ac14328c4aee103fbae2adc10e089f0bb8882f25256e1fb5cb61b367ad70f8b7fd07c474cca5f53641a369eb019a426a7206250b866b4fa

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-47914.exe

Filesize
468KB

MD5
487b37f87189c5aa81e8b628d662b27d

SHA1
68d82556e24cdae6463607c909a5dee91960d0f6

SHA256
22235a90f16b38789b258c14b63224077db4ea2c8346023759c9e0c686283bfb

SHA512
3daf6b652e592b707f1ee4109979cec5628e845d01c1c89487a4302deb562f76ce8081722887b3262e3ee5aff651165f74acb1599fa2785e2a94748f72b4ce04

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-6741.exe

Filesize
468KB

MD5
a8b0406f6db8bd35b5fe98a329f8e004

SHA1
c4461822a18fa70a426942205eaafbdd46d781c5

SHA256
4cb94377bafe5eda8c1c7047f5ae70f054b35c0f3e0347fa7788b3f370a0808c

SHA512
8a72a18484efe2e18a267f809c82f96bb4bd31e6ac791ca0a5bbd9f6424e9d055a107e902b9fb8d0f1151cad9217e709131a6e92da9b463d4c4e427f84a5fa32

Download Submit