9f5d595ecd094f6f15d5d3adfe47536454be8677f472e3db92a3e83106e7db0d

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30/09/2024, 02:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9f5d595ecd094f6f15d5d3adfe47536454be8677f472e3db92a3e83106e7db0dN.exe
Size

468KB
MD5

fdea090a4e2a297c30293349b74ef9a0
SHA1

3b31cae86ffc6e11e1d317d70a1d91506d11e70f
SHA256

9f5d595ecd094f6f15d5d3adfe47536454be8677f472e3db92a3e83106e7db0d
SHA512

081565a9cf9fb1faca10796a9dddf14ab2f79a2803714b22392c85bdd4a2f944a0c892071f34b26ba175bdf62fe0ffc8e0e9ff483c3b1968e9c44ac4fa96e2c0
SSDEEP

3072:lGoHogIKk05Q7bYyHz9OcfrwChzP0p0QLHeaVP+IPfLO2Vg/Flm:lGIo38Q7tHJOcfTY2nIPjBVg/

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2784	Unicorn-23184.exe
2700	Unicorn-64738.exe
2900	Unicorn-25521.exe
2884	Unicorn-60260.exe
2632	Unicorn-8106.exe
2256	Unicorn-51883.exe
2484	Unicorn-58013.exe
1500	Unicorn-36662.exe
1368	Unicorn-29567.exe
2828	Unicorn-48063.exe
3016	Unicorn-34669.exe
2752	Unicorn-34934.exe
328	Unicorn-28816.exe
2288	Unicorn-22685.exe
1348	Unicorn-8950.exe
1768	Unicorn-42760.exe
3000	Unicorn-63154.exe
1196	Unicorn-2241.exe
680	Unicorn-17465.exe
1664	Unicorn-3730.exe
2536	Unicorn-23596.exe
1476	Unicorn-23596.exe
784	Unicorn-44899.exe
1048	Unicorn-53829.exe
2248	Unicorn-21083.exe
352	Unicorn-21349.exe
2532	Unicorn-51482.exe
1956	Unicorn-57789.exe
2464	Unicorn-55713.exe
2896	Unicorn-24157.exe
1220	Unicorn-7882.exe
2052	Unicorn-42858.exe
2696	Unicorn-56594.exe
2456	Unicorn-30244.exe
2720	Unicorn-54491.exe
2760	Unicorn-32580.exe
2604	Unicorn-7776.exe
2684	Unicorn-7968.exe
2680	Unicorn-55742.exe
2584	Unicorn-55742.exe
2588	Unicorn-49612.exe
2920	Unicorn-36644.exe
2200	Unicorn-36836.exe
980	Unicorn-56702.exe
2428	Unicorn-51420.exe
1676	Unicorn-12602.exe
2000	Unicorn-45394.exe
3012	Unicorn-55970.exe
2940	Unicorn-10298.exe
3052	Unicorn-41278.exe
988	Unicorn-17471.exe
2308	Unicorn-63910.exe
1428	Unicorn-18239.exe
2136	Unicorn-12134.exe
1976	Unicorn-51321.exe
936	Unicorn-2815.exe
2440	Unicorn-22681.exe
1680	Unicorn-34531.exe
948	Unicorn-47495.exe
900	Unicorn-53360.exe
1780	Unicorn-21337.exe
1028	Unicorn-47434.exe
1436	Unicorn-30678.exe
2892	Unicorn-30678.exe

Loads dropped DLL 64 IoCs

pid	Process
1152	9f5d595ecd094f6f15d5d3adfe47536454be8677f472e3db92a3e83106e7db0dN.exe
1152	9f5d595ecd094f6f15d5d3adfe47536454be8677f472e3db92a3e83106e7db0dN.exe
2784	Unicorn-23184.exe
1152	9f5d595ecd094f6f15d5d3adfe47536454be8677f472e3db92a3e83106e7db0dN.exe
2784	Unicorn-23184.exe
1152	9f5d595ecd094f6f15d5d3adfe47536454be8677f472e3db92a3e83106e7db0dN.exe
2700	Unicorn-64738.exe
2700	Unicorn-64738.exe
2784	Unicorn-23184.exe
2784	Unicorn-23184.exe
1152	9f5d595ecd094f6f15d5d3adfe47536454be8677f472e3db92a3e83106e7db0dN.exe
2900	Unicorn-25521.exe
1152	9f5d595ecd094f6f15d5d3adfe47536454be8677f472e3db92a3e83106e7db0dN.exe
2900	Unicorn-25521.exe
2884	Unicorn-60260.exe
2884	Unicorn-60260.exe
2700	Unicorn-64738.exe
2700	Unicorn-64738.exe
2256	Unicorn-51883.exe
2256	Unicorn-51883.exe
1152	9f5d595ecd094f6f15d5d3adfe47536454be8677f472e3db92a3e83106e7db0dN.exe
1152	9f5d595ecd094f6f15d5d3adfe47536454be8677f472e3db92a3e83106e7db0dN.exe
2484	Unicorn-58013.exe
2484	Unicorn-58013.exe
2632	Unicorn-8106.exe
2632	Unicorn-8106.exe
2784	Unicorn-23184.exe
2900	Unicorn-25521.exe
2784	Unicorn-23184.exe
2900	Unicorn-25521.exe
1500	Unicorn-36662.exe
1500	Unicorn-36662.exe
2884	Unicorn-60260.exe
2884	Unicorn-60260.exe
2880	WerFault.exe
2880	WerFault.exe
2880	WerFault.exe
2880	WerFault.exe
2880	WerFault.exe
2880	WerFault.exe
2880	WerFault.exe
2880	WerFault.exe
1368	Unicorn-29567.exe
1368	Unicorn-29567.exe
2880	WerFault.exe
2700	Unicorn-64738.exe
2700	Unicorn-64738.exe
2484	Unicorn-58013.exe
2484	Unicorn-58013.exe
3016	Unicorn-34669.exe
328	Unicorn-28816.exe
3016	Unicorn-34669.exe
328	Unicorn-28816.exe
1152	9f5d595ecd094f6f15d5d3adfe47536454be8677f472e3db92a3e83106e7db0dN.exe
2288	Unicorn-22685.exe
1152	9f5d595ecd094f6f15d5d3adfe47536454be8677f472e3db92a3e83106e7db0dN.exe
2288	Unicorn-22685.exe
2784	Unicorn-23184.exe
2784	Unicorn-23184.exe
1348	Unicorn-8950.exe
1348	Unicorn-8950.exe
2900	Unicorn-25521.exe
2900	Unicorn-25521.exe
1768	Unicorn-42760.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2880	3000	WerFault.exe	47
3884	2788	WerFault.exe	104

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13765.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63026.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11805.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16592.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9642.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26685.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14580.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65451.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35351.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12520.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58980.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50900.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13765.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1719.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61780.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58980.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30676.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23655.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3751.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2108.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34356.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17471.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34434.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9108.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44162.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58980.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62070.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7882.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49744.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32561.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28816.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2241.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11805.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34669.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51321.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36036.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13685.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27216.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57690.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29567.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32644.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17670.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19210.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12276.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64738.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34531.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10150.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31419.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28834.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63910.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35783.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35351.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5689.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13068.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21349.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-835.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21000.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26685.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4550.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56647.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53183.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9932.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-305.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31271.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1152	9f5d595ecd094f6f15d5d3adfe47536454be8677f472e3db92a3e83106e7db0dN.exe
2784	Unicorn-23184.exe
2700	Unicorn-64738.exe
2900	Unicorn-25521.exe
2884	Unicorn-60260.exe
2256	Unicorn-51883.exe
2632	Unicorn-8106.exe
2484	Unicorn-58013.exe
1500	Unicorn-36662.exe
1368	Unicorn-29567.exe
2752	Unicorn-34934.exe
2288	Unicorn-22685.exe
3016	Unicorn-34669.exe
2828	Unicorn-48063.exe
328	Unicorn-28816.exe
1348	Unicorn-8950.exe
1768	Unicorn-42760.exe
3000	Unicorn-63154.exe
1196	Unicorn-2241.exe
680	Unicorn-17465.exe
1664	Unicorn-3730.exe
1476	Unicorn-23596.exe
2536	Unicorn-23596.exe
784	Unicorn-44899.exe
1048	Unicorn-53829.exe
2248	Unicorn-21083.exe
352	Unicorn-21349.exe
2532	Unicorn-51482.exe
1956	Unicorn-57789.exe
2464	Unicorn-55713.exe
2896	Unicorn-24157.exe
1220	Unicorn-7882.exe
2052	Unicorn-42858.exe
2696	Unicorn-56594.exe
2456	Unicorn-30244.exe
2720	Unicorn-54491.exe
2760	Unicorn-32580.exe
2588	Unicorn-49612.exe
2604	Unicorn-7776.exe
2680	Unicorn-55742.exe
2584	Unicorn-55742.exe
2684	Unicorn-7968.exe
2428	Unicorn-51420.exe
2920	Unicorn-36644.exe
2200	Unicorn-36836.exe
980	Unicorn-56702.exe
1676	Unicorn-12602.exe
2940	Unicorn-10298.exe
2000	Unicorn-45394.exe
3012	Unicorn-55970.exe
3052	Unicorn-41278.exe
988	Unicorn-17471.exe
2308	Unicorn-63910.exe
1428	Unicorn-18239.exe
2136	Unicorn-12134.exe
936	Unicorn-2815.exe
2440	Unicorn-22681.exe
1976	Unicorn-51321.exe
1680	Unicorn-34531.exe
900	Unicorn-53360.exe
948	Unicorn-47495.exe
1780	Unicorn-21337.exe
1436	Unicorn-30678.exe
1028	Unicorn-47434.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 2784	1152	9f5d595ecd094f6f15d5d3adfe47536454be8677f472e3db92a3e83106e7db0dN.exe	31
PID 1152 wrote to memory of 2784	1152	9f5d595ecd094f6f15d5d3adfe47536454be8677f472e3db92a3e83106e7db0dN.exe	31
PID 1152 wrote to memory of 2784	1152	9f5d595ecd094f6f15d5d3adfe47536454be8677f472e3db92a3e83106e7db0dN.exe	31
PID 1152 wrote to memory of 2784	1152	9f5d595ecd094f6f15d5d3adfe47536454be8677f472e3db92a3e83106e7db0dN.exe	31
PID 2784 wrote to memory of 2700	2784	Unicorn-23184.exe	32
PID 2784 wrote to memory of 2700	2784	Unicorn-23184.exe	32
PID 2784 wrote to memory of 2700	2784	Unicorn-23184.exe	32
PID 2784 wrote to memory of 2700	2784	Unicorn-23184.exe	32
PID 1152 wrote to memory of 2900	1152	9f5d595ecd094f6f15d5d3adfe47536454be8677f472e3db92a3e83106e7db0dN.exe	33
PID 1152 wrote to memory of 2900	1152	9f5d595ecd094f6f15d5d3adfe47536454be8677f472e3db92a3e83106e7db0dN.exe	33
PID 1152 wrote to memory of 2900	1152	9f5d595ecd094f6f15d5d3adfe47536454be8677f472e3db92a3e83106e7db0dN.exe	33
PID 1152 wrote to memory of 2900	1152	9f5d595ecd094f6f15d5d3adfe47536454be8677f472e3db92a3e83106e7db0dN.exe	33
PID 2700 wrote to memory of 2884	2700	Unicorn-64738.exe	34
PID 2700 wrote to memory of 2884	2700	Unicorn-64738.exe	34
PID 2700 wrote to memory of 2884	2700	Unicorn-64738.exe	34
PID 2700 wrote to memory of 2884	2700	Unicorn-64738.exe	34
PID 2784 wrote to memory of 2632	2784	Unicorn-23184.exe	35
PID 2784 wrote to memory of 2632	2784	Unicorn-23184.exe	35
PID 2784 wrote to memory of 2632	2784	Unicorn-23184.exe	35
PID 2784 wrote to memory of 2632	2784	Unicorn-23184.exe	35
PID 1152 wrote to memory of 2256	1152	9f5d595ecd094f6f15d5d3adfe47536454be8677f472e3db92a3e83106e7db0dN.exe	36
PID 1152 wrote to memory of 2256	1152	9f5d595ecd094f6f15d5d3adfe47536454be8677f472e3db92a3e83106e7db0dN.exe	36
PID 1152 wrote to memory of 2256	1152	9f5d595ecd094f6f15d5d3adfe47536454be8677f472e3db92a3e83106e7db0dN.exe	36
PID 1152 wrote to memory of 2256	1152	9f5d595ecd094f6f15d5d3adfe47536454be8677f472e3db92a3e83106e7db0dN.exe	36
PID 2900 wrote to memory of 2484	2900	Unicorn-25521.exe	37
PID 2900 wrote to memory of 2484	2900	Unicorn-25521.exe	37
PID 2900 wrote to memory of 2484	2900	Unicorn-25521.exe	37
PID 2900 wrote to memory of 2484	2900	Unicorn-25521.exe	37
PID 2884 wrote to memory of 1500	2884	Unicorn-60260.exe	38
PID 2884 wrote to memory of 1500	2884	Unicorn-60260.exe	38
PID 2884 wrote to memory of 1500	2884	Unicorn-60260.exe	38
PID 2884 wrote to memory of 1500	2884	Unicorn-60260.exe	38
PID 2700 wrote to memory of 1368	2700	Unicorn-64738.exe	39
PID 2700 wrote to memory of 1368	2700	Unicorn-64738.exe	39
PID 2700 wrote to memory of 1368	2700	Unicorn-64738.exe	39
PID 2700 wrote to memory of 1368	2700	Unicorn-64738.exe	39
PID 2256 wrote to memory of 2828	2256	Unicorn-51883.exe	40
PID 2256 wrote to memory of 2828	2256	Unicorn-51883.exe	40
PID 2256 wrote to memory of 2828	2256	Unicorn-51883.exe	40
PID 2256 wrote to memory of 2828	2256	Unicorn-51883.exe	40
PID 1152 wrote to memory of 3016	1152	9f5d595ecd094f6f15d5d3adfe47536454be8677f472e3db92a3e83106e7db0dN.exe	41
PID 1152 wrote to memory of 3016	1152	9f5d595ecd094f6f15d5d3adfe47536454be8677f472e3db92a3e83106e7db0dN.exe	41
PID 1152 wrote to memory of 3016	1152	9f5d595ecd094f6f15d5d3adfe47536454be8677f472e3db92a3e83106e7db0dN.exe	41
PID 1152 wrote to memory of 3016	1152	9f5d595ecd094f6f15d5d3adfe47536454be8677f472e3db92a3e83106e7db0dN.exe	41
PID 2484 wrote to memory of 2752	2484	Unicorn-58013.exe	42
PID 2484 wrote to memory of 2752	2484	Unicorn-58013.exe	42
PID 2484 wrote to memory of 2752	2484	Unicorn-58013.exe	42
PID 2484 wrote to memory of 2752	2484	Unicorn-58013.exe	42
PID 2632 wrote to memory of 328	2632	Unicorn-8106.exe	43
PID 2632 wrote to memory of 328	2632	Unicorn-8106.exe	43
PID 2632 wrote to memory of 328	2632	Unicorn-8106.exe	43
PID 2632 wrote to memory of 328	2632	Unicorn-8106.exe	43
PID 2784 wrote to memory of 2288	2784	Unicorn-23184.exe	44
PID 2784 wrote to memory of 2288	2784	Unicorn-23184.exe	44
PID 2784 wrote to memory of 2288	2784	Unicorn-23184.exe	44
PID 2784 wrote to memory of 2288	2784	Unicorn-23184.exe	44
PID 2900 wrote to memory of 1348	2900	Unicorn-25521.exe	45
PID 2900 wrote to memory of 1348	2900	Unicorn-25521.exe	45
PID 2900 wrote to memory of 1348	2900	Unicorn-25521.exe	45
PID 2900 wrote to memory of 1348	2900	Unicorn-25521.exe	45
PID 1500 wrote to memory of 1768	1500	Unicorn-36662.exe	46
PID 1500 wrote to memory of 1768	1500	Unicorn-36662.exe	46
PID 1500 wrote to memory of 1768	1500	Unicorn-36662.exe	46
PID 1500 wrote to memory of 1768	1500	Unicorn-36662.exe	46

C:\Users\Admin\AppData\Local\Temp\9f5d595ecd094f6f15d5d3adfe47536454be8677f472e3db92a3e83106e7db0dN.exe
"C:\Users\Admin\AppData\Local\Temp\9f5d595ecd094f6f15d5d3adfe47536454be8677f472e3db92a3e83106e7db0dN.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23184.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23184.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64738.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64738.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60260.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60260.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36662.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42760.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57789.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17471.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23655.exe
        9⤵
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17936.exe
        10⤵
        
        PID:3688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47438.exe
        10⤵
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13319.exe
        10⤵
        
        PID:4996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43451.exe
        10⤵
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63607.exe
        9⤵
        
        PID:3588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61173.exe
        9⤵
        
        PID:4736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53694.exe
        9⤵
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50245.exe
        9⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51044.exe
        8⤵
        
        PID:2952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32945.exe
        8⤵
        
        PID:4052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44079.exe
        8⤵
        
        PID:4344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12520.exe
        8⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62070.exe
        8⤵
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63910.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7381.exe
        8⤵
        
        PID:2064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3751.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38214.exe
        8⤵
        
        PID:932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58980.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1954.exe
        8⤵
        
        PID:7156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21344.exe
        7⤵
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44576.exe
        7⤵
        
        PID:3944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10150.exe
        7⤵
        
        PID:3812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54547.exe
        7⤵
        
        PID:5200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55713.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18239.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48699.exe
        8⤵
        
        PID:1828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19210.exe
        8⤵
        
        PID:3672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23377.exe
        8⤵
        
        PID:4884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14631.exe
        8⤵
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13068.exe
        8⤵
        
        PID:6172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45663.exe
        7⤵
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32945.exe
        7⤵
        
        PID:4084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44079.exe
        7⤵
        
        PID:4352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12520.exe
        7⤵
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62070.exe
        7⤵
        
        PID:5460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12134.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50324.exe
        7⤵
        
        PID:604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54907.exe
        7⤵
        
        PID:3132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29485.exe
        7⤵
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2108.exe
        7⤵
        
        PID:5608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47955.exe
        7⤵
        
        PID:7032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37096.exe
        6⤵
        
        PID:612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-305.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10150.exe
        6⤵
        
        PID:4204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54547.exe
        6⤵
        
        PID:5216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63154.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3000
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3000 -s 200
        6⤵
        Loads dropped DLL
        Program crash
        
        PID:2880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5646.exe
        5⤵
        
        PID:2444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17936.exe
        6⤵
        
        PID:3676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47438.exe
        6⤵
        
        PID:4544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13319.exe
        6⤵
        
        PID:4972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24894.exe
        6⤵
        
        PID:976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17670.exe
        5⤵
        
        PID:3524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58373.exe
        5⤵
        
        PID:4628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5134.exe
        5⤵
        
        PID:5844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13598.exe
        5⤵
        
        PID:5976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29567.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29567.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2241.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24157.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51321.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58253.exe
        8⤵
        
        PID:2176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61173.exe
        8⤵
        
        PID:4696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61092.exe
        8⤵
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13765.exe
        8⤵
        
        PID:6728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3027.exe
        7⤵
        
        PID:1948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47376.exe
        7⤵
        
        PID:3112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35351.exe
        7⤵
        
        PID:916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58980.exe
        7⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13765.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2815.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23655.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
        8⤵
        
        PID:2864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17936.exe
        9⤵
        
        PID:3728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47438.exe
        9⤵
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32561.exe
        9⤵
        
        PID:792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40436.exe
        9⤵
        
        PID:4944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63607.exe
        8⤵
        
        PID:3544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61173.exe
        8⤵
        
        PID:4704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32063.exe
        8⤵
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62070.exe
        8⤵
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2278.exe
        7⤵
        
        PID:3124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3105.exe
        7⤵
        
        PID:3928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35351.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58980.exe
        7⤵
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31419.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64779.exe
        6⤵
        
        PID:1636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38811.exe
        6⤵
        
        PID:4032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18200.exe
        6⤵
        
        PID:4528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59510.exe
        6⤵
        
        PID:5828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63026.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7882.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22681.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61804.exe
        7⤵
        
        PID:684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21881.exe
        8⤵
        
        PID:1928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19210.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38214.exe
        8⤵
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58980.exe
        8⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34434.exe
        8⤵
        
        PID:6888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8953.exe
        7⤵
        
        PID:1728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32945.exe
        7⤵
        
        PID:3080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44079.exe
        7⤵
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12520.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62070.exe
        7⤵
        
        PID:5132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49744.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60570.exe
        7⤵
        
        PID:6536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11805.exe
        6⤵
        
        PID:3496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1501.exe
        6⤵
        
        PID:4744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2045.exe
        6⤵
        
        PID:5332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62070.exe
        6⤵
        
        PID:5948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34531.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3805.exe
        6⤵
        
        PID:1612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19210.exe
        6⤵
        
        PID:4060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35355.exe
        6⤵
        
        PID:4916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64770.exe
        6⤵
        
        PID:5304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44568.exe
        5⤵
        
        PID:1756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14945.exe
        6⤵
        
        PID:2664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47419.exe
        6⤵
        
        PID:3856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35355.exe
        6⤵
        
        PID:4472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31770.exe
        6⤵
        
        PID:6128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33830.exe
        5⤵
        
        PID:2672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49306.exe
        5⤵
        
        PID:3796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27216.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37979.exe
        5⤵
        
        PID:5792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57690.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17465.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17465.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30244.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64720.exe
        6⤵
        
        PID:1040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44278.exe
        7⤵
        
        PID:1712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19210.exe
        7⤵
        
        PID:3188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38214.exe
        7⤵
        
        PID:4292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58980.exe
        7⤵
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34626.exe
        7⤵
        
        PID:7040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35315.exe
        6⤵
        
        PID:2592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17486.exe
        6⤵
        
        PID:4020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43519.exe
        6⤵
        
        PID:780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48234.exe
        6⤵
        
        PID:5660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16214.exe
        5⤵
        
        PID:2488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8936.exe
        6⤵
        
        PID:952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9642.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52422.exe
        6⤵
        
        PID:5916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62070.exe
        6⤵
        
        PID:6156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1270.exe
        5⤵
        
        PID:2168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8970.exe
        5⤵
        
        PID:3964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26685.exe
        5⤵
        
        PID:4212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42444.exe
        5⤵
        
        PID:5592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30831.exe
        5⤵
        
        PID:6760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54491.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30678.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52503.exe
        6⤵
        
        PID:1816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47376.exe
        6⤵
        
        PID:3144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35351.exe
        6⤵
        
        PID:4100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58980.exe
        6⤵
        
        PID:5480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34626.exe
        6⤵
        
        PID:7020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11838.exe
        5⤵
        
        PID:2724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32945.exe
        5⤵
        
        PID:1372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44079.exe
        5⤵
        
        PID:4368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12520.exe
        5⤵
        
        PID:5528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62070.exe
        5⤵
        
        PID:5932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22733.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22733.exe
      4⤵
      PID:2116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1719.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19210.exe
        5⤵
        
        PID:3156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3860.exe
        5⤵
        
        PID:3988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41086.exe
        5⤵
        
        PID:6064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31007.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31007.exe
      4⤵
      PID:2964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30676.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30676.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14413.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14413.exe
      4⤵
      PID:4224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51721.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51721.exe
      4⤵
      PID:5688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56470.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56470.exe
      4⤵
      PID:5140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8106.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8106.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28816.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28816.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23596.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55742.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52525.exe
        7⤵
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19210.exe
        8⤵
        
        PID:3192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21000.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58980.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34434.exe
        8⤵
        
        PID:6952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9932.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53183.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26689.exe
        7⤵
        
        PID:4488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15235.exe
        7⤵
        
        PID:5240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57268.exe
        6⤵
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3805.exe
        7⤵
        
        PID:632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19210.exe
        7⤵
        
        PID:3136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52184.exe
        7⤵
        
        PID:4476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64770.exe
        7⤵
        
        PID:5308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38703.exe
        6⤵
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14989.exe
        7⤵
        
        PID:2756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39447.exe
        7⤵
        
        PID:3932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29485.exe
        7⤵
        
        PID:4868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2108.exe
        7⤵
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30300.exe
        7⤵
        
        PID:6792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19550.exe
        6⤵
        
        PID:1936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7892.exe
        6⤵
        
        PID:4144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10150.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59510.exe
        6⤵
        
        PID:5820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63026.exe
        6⤵
        
        PID:7092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36644.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44591.exe
        6⤵
        
        PID:1740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17704.exe
        7⤵
        
        PID:3028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54907.exe
        7⤵
        
        PID:3840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29485.exe
        7⤵
        
        PID:4836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2108.exe
        7⤵
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50970.exe
        7⤵
        
        PID:6912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38411.exe
        6⤵
        
        PID:2528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61730.exe
        6⤵
        
        PID:4268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35351.exe
        6⤵
        
        PID:4432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58980.exe
        6⤵
        
        PID:5652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34434.exe
        6⤵
        
        PID:6920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55674.exe
        5⤵
        
        PID:300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60668.exe
        6⤵
        
        PID:6228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17670.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58373.exe
        5⤵
        
        PID:4680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58478.exe
        5⤵
        
        PID:5144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65300.exe
        5⤵
        
        PID:5252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56594.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56594.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21337.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60110.exe
        6⤵
        
        PID:568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32945.exe
        6⤵
        
        PID:1052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44079.exe
        6⤵
        
        PID:4380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12520.exe
        6⤵
        
        PID:5496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62070.exe
        6⤵
        
        PID:1396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2603.exe
        5⤵
        
        PID:2088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17936.exe
        6⤵
        
        PID:3744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47438.exe
        6⤵
        
        PID:4616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32561.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40436.exe
        6⤵
        
        PID:6060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11805.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1501.exe
        5⤵
        
        PID:4752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2045.exe
        5⤵
        
        PID:5340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62070.exe
        5⤵
        
        PID:5944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47434.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19816.exe
        5⤵
        
        PID:1644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47995.exe
        5⤵
        
        PID:4232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29485.exe
        5⤵
        
        PID:5036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2108.exe
        5⤵
        
        PID:5876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50970.exe
        5⤵
        
        PID:6980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9541.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9541.exe
      4⤵
      PID:1700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42586.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42586.exe
      4⤵
      PID:4328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5689.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5689.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38434.exe
      4⤵
      PID:5244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22685.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22685.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53829.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53829.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10298.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11596.exe
        6⤵
        
        PID:2788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39914.exe
        7⤵
        
        PID:904
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 236
        7⤵
        Program crash
        
        PID:3884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31226.exe
        6⤵
        
        PID:2888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51071.exe
        6⤵
        
        PID:3832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35351.exe
        6⤵
        
        PID:4152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58980.exe
        6⤵
        
        PID:5436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13765.exe
        6⤵
        
        PID:6736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39504.exe
        5⤵
        
        PID:2644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5051.exe
        6⤵
        
        PID:2164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19210.exe
        6⤵
        
        PID:3664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38214.exe
        6⤵
        
        PID:4420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58980.exe
        6⤵
        
        PID:5404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34626.exe
        6⤵
        
        PID:7012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36036.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23352.exe
        5⤵
        
        PID:4008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35413.exe
        5⤵
        
        PID:4176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36156.exe
        5⤵
        
        PID:5212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41278.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51342.exe
        5⤵
        
        PID:2796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44162.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48187.exe
        6⤵
        
        PID:4336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29485.exe
        6⤵
        
        PID:4892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2108.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50970.exe
        6⤵
        
        PID:6968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54608.exe
        5⤵
        
        PID:1760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3105.exe
        5⤵
        
        PID:3952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35351.exe
        5⤵
        
        PID:996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58980.exe
        5⤵
        
        PID:5492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13765.exe
        5⤵
        
        PID:6804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19742.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19742.exe
      4⤵
      PID:2928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16591.exe
        5⤵
        
        PID:1528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22618.exe
        5⤵
        
        PID:4100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61173.exe
        5⤵
        
        PID:4648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38427.exe
        5⤵
        
        PID:5004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50245.exe
        5⤵
        
        PID:5892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24733.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24733.exe
      4⤵
      PID:1560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-305.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-305.exe
      4⤵
      PID:4004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10150.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10150.exe
      4⤵
      PID:4228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54547.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54547.exe
      4⤵
      PID:5168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21083.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21083.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56702.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56702.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25510.exe
        5⤵
        
        PID:2392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43482.exe
        5⤵
        
        PID:3864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61173.exe
        5⤵
        
        PID:4792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18141.exe
        5⤵
        
        PID:5192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31770.exe
        5⤵
        
        PID:3064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48205.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48205.exe
      4⤵
      PID:2180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38811.exe
      4⤵
      PID:4092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63862.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63862.exe
      4⤵
      PID:4116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23219.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23219.exe
      4⤵
      PID:5280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51420.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51420.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18068.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18068.exe
      4⤵
      PID:1632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13529.exe
        5⤵
        
        PID:3712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61173.exe
        5⤵
        
        PID:4728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52422.exe
        5⤵
        
        PID:5908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62070.exe
        5⤵
        
        PID:6188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11805.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11805.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1501.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1501.exe
      4⤵
      PID:4760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2045.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2045.exe
      4⤵
      PID:5356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62070.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62070.exe
      4⤵
      PID:5960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40759.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40759.exe
    3⤵
    PID:3020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32727.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32727.exe
      4⤵
      PID:2908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14696.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14696.exe
      4⤵
      PID:4952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12520.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12520.exe
      4⤵
      PID:5568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62070.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62070.exe
      4⤵
      PID:5320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28961.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28961.exe
    3⤵
    PID:2520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29382.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29382.exe
    3⤵
    PID:3852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-350.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-350.exe
    3⤵
    PID:4624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36844.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36844.exe
    3⤵
    PID:5684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34155.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34155.exe
    3⤵
    PID:7084
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25521.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25521.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58013.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58013.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34934.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34934.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42858.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30678.exe
        6⤵
        Executes dropped EXE
        
        PID:2892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65451.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48630.exe
        7⤵
        
        PID:4988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12520.exe
        7⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62070.exe
        7⤵
        
        PID:6180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58313.exe
        6⤵
        
        PID:1604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1501.exe
        6⤵
        
        PID:4672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8407.exe
        6⤵
        
        PID:5184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18250.exe
        6⤵
        
        PID:5680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7552.exe
        5⤵
        
        PID:580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35280.exe
        6⤵
        
        PID:2224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19210.exe
        6⤵
        
        PID:3148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38214.exe
        6⤵
        
        PID:4308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58980.exe
        6⤵
        
        PID:5392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35783.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30145.exe
        5⤵
        
        PID:3760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18878.exe
        5⤵
        
        PID:4404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13050.exe
        5⤵
        
        PID:5636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57604.exe
        5⤵
        
        PID:6020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3730.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3730.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7968.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10849.exe
        6⤵
        
        PID:1552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24577.exe
        7⤵
        
        PID:3824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31271.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61780.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38966.exe
        7⤵
        
        PID:6812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63607.exe
        6⤵
        
        PID:3572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61173.exe
        6⤵
        
        PID:4712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10710.exe
        6⤵
        
        PID:5348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13068.exe
        6⤵
        
        PID:6196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18799.exe
        5⤵
        
        PID:2212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37553.exe
        6⤵
        
        PID:3008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61173.exe
        6⤵
        
        PID:4720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32063.exe
        6⤵
        
        PID:5772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62070.exe
        6⤵
        
        PID:6052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13685.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8970.exe
        5⤵
        
        PID:3980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26685.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42444.exe
        5⤵
        
        PID:5600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30831.exe
        5⤵
        
        PID:6776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49612.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49612.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59370.exe
        5⤵
        
        PID:2912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17460.exe
        6⤵
        
        PID:2856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27924.exe
        6⤵
        
        PID:4500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20445.exe
        6⤵
        
        PID:4928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31770.exe
        6⤵
        
        PID:4964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17495.exe
        5⤵
        
        PID:2104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3105.exe
        5⤵
        
        PID:3848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35351.exe
        5⤵
        
        PID:3908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58980.exe
        5⤵
        
        PID:5412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13765.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28078.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28078.exe
      4⤵
      PID:2220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56665.exe
        5⤵
        
        PID:544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19210.exe
        5⤵
        
        PID:3552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38214.exe
        5⤵
        
        PID:4316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58980.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34434.exe
        5⤵
        
        PID:6856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63028.exe
      4⤵
      PID:2852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43586.exe
        5⤵
        
        PID:1540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27924.exe
        5⤵
        
        PID:4492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20445.exe
        5⤵
        
        PID:2356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64770.exe
        5⤵
        
        PID:3056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6610.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6610.exe
      4⤵
      PID:2972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59460.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59460.exe
      4⤵
      PID:4260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-354.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-354.exe
      4⤵
      PID:896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12650.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12650.exe
      4⤵
      PID:5812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8950.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8950.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21349.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21349.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12602.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52503.exe
        6⤵
        
        PID:1036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47376.exe
        6⤵
        
        PID:3684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35351.exe
        6⤵
        
        PID:4444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58980.exe
        6⤵
        
        PID:5736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31419.exe
        6⤵
        
        PID:6992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62876.exe
        5⤵
        
        PID:2692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32945.exe
        5⤵
        
        PID:4076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26866.exe
        5⤵
        
        PID:4508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12520.exe
        5⤵
        
        PID:5552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62070.exe
        5⤵
        
        PID:6164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55970.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55970.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7912.exe
        5⤵
        
        PID:1616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55392.exe
        6⤵
        
        PID:3168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65457.exe
        6⤵
        
        PID:4408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35355.exe
        6⤵
        
        PID:4460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31770.exe
        6⤵
        
        PID:4976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13529.exe
        5⤵
        
        PID:3704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61173.exe
        5⤵
        
        PID:4800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17840.exe
        5⤵
        
        PID:5260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31770.exe
        5⤵
        
        PID:5836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50900.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50900.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17936.exe
        5⤵
        
        PID:3736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47438.exe
        5⤵
        
        PID:4580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32561.exe
        5⤵
        
        PID:4920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58910.exe
        5⤵
        
        PID:5992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17670.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17670.exe
      4⤵
      PID:3612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58373.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58373.exe
      4⤵
      PID:4688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28493.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28493.exe
      4⤵
      PID:3876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50557.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50557.exe
      4⤵
      PID:6448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51482.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51482.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34003.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34003.exe
      4⤵
      PID:2708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2991.exe
        5⤵
        
        PID:2820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3751.exe
        5⤵
        
        PID:3972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3860.exe
        5⤵
        
        PID:2232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31770.exe
        5⤵
        
        PID:5116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51547.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51547.exe
      4⤵
      PID:2188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53241.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53241.exe
      4⤵
      PID:3984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26685.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42444.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42444.exe
      4⤵
      PID:5632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51500.exe
      4⤵
      PID:6900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45394.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45394.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25873.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25873.exe
      4⤵
      PID:1784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33395.exe
        5⤵
        
        PID:3768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47438.exe
        5⤵
        
        PID:4636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27818.exe
        5⤵
        
        PID:5292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40436.exe
        5⤵
        
        PID:6140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63607.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63607.exe
      4⤵
      PID:3596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33363.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33363.exe
      4⤵
      PID:5012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12520.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12520.exe
      4⤵
      PID:5504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62070.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62070.exe
      4⤵
      PID:5160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63616.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63616.exe
    3⤵
    PID:444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11790.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11790.exe
      4⤵
      PID:1192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22618.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22618.exe
      4⤵
      PID:4108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12520.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12520.exe
      4⤵
      PID:5512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62070.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62070.exe
      4⤵
      PID:5176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56662.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56662.exe
    3⤵
    PID:1444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-835.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-835.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5685.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5685.exe
    3⤵
    PID:4564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32644.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32644.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28834.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28834.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6960
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51883.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51883.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48063.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48063.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47495.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47495.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3779.exe
        5⤵
        
        PID:2552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19210.exe
        5⤵
        
        PID:3492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3860.exe
        5⤵
        
        PID:4184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31770.exe
        5⤵
        
        PID:4940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1402.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1402.exe
      4⤵
      PID:1508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17936.exe
        5⤵
        
        PID:3752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47438.exe
        5⤵
        
        PID:4656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12276.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43451.exe
        5⤵
        
        PID:5448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9005.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9005.exe
      4⤵
      PID:3556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41837.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41837.exe
      4⤵
      PID:4596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11049.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11049.exe
      4⤵
      PID:5008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13785.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13785.exe
      4⤵
      PID:5816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53360.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53360.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37553.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37553.exe
      4⤵
      PID:1560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2086.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2086.exe
      4⤵
      PID:3092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61730.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61730.exe
      4⤵
      PID:4248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35351.exe
      4⤵
      PID:4188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58980.exe
      4⤵
      PID:5664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34626.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34626.exe
      4⤵
      PID:7052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10885.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10885.exe
    3⤵
    PID:2348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49306.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49306.exe
    3⤵
    PID:3924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5689.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5689.exe
    3⤵
    PID:4484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23909.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23909.exe
    3⤵
    PID:5928
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34669.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34669.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23596.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23596.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55742.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55742.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54949.exe
        5⤵
        
        PID:1996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24998.exe
        6⤵
        
        PID:2004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62494.exe
        6⤵
        
        PID:4136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35355.exe
        6⤵
        
        PID:4908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64770.exe
        6⤵
        
        PID:5272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13529.exe
        5⤵
        
        PID:3696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61173.exe
        5⤵
        
        PID:4808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42444.exe
        5⤵
        
        PID:5696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51500.exe
        5⤵
        
        PID:6932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8308.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8308.exe
      4⤵
      PID:2656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38811.exe
      4⤵
      PID:3104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35413.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35413.exe
      4⤵
      PID:4216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61522.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61522.exe
      4⤵
      PID:5712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13598.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13598.exe
      4⤵
      PID:5128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36836.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36836.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3789.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3789.exe
      4⤵
      PID:1832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32945.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32945.exe
      4⤵
      PID:3116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44079.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44079.exe
      4⤵
      PID:4400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12520.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12520.exe
      4⤵
      PID:5584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62070.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62070.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-879.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-879.exe
    3⤵
    PID:1148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20573.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20573.exe
      4⤵
      PID:4852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56647.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15868.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15868.exe
      4⤵
      PID:6012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17670.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17670.exe
    3⤵
    PID:3604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58373.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58373.exe
    3⤵
    PID:4664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60782.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60782.exe
    3⤵
    PID:4816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34356.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34356.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5324
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44899.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44899.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7776.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7776.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10605.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10605.exe
      4⤵
      PID:536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5051.exe
        5⤵
        
        PID:1432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19210.exe
        5⤵
        
        PID:3564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38214.exe
        5⤵
        
        PID:3816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21185.exe
        5⤵
        
        PID:5720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13068.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22300.exe
      4⤵
      PID:2036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32945.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32945.exe
      4⤵
      PID:4068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44079.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44079.exe
      4⤵
      PID:4388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12520.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12520.exe
      4⤵
      PID:5576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60934.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60934.exe
      4⤵
      PID:6696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35083.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35083.exe
    3⤵
    PID:2144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16592.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16592.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47438.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47438.exe
      4⤵
      PID:4604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14580.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14580.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43451.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43451.exe
      4⤵
      PID:5384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11805.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11805.exe
    3⤵
    PID:3580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1501.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1501.exe
    3⤵
    PID:4768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29761.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29761.exe
    3⤵
    PID:4948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6551.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6551.exe
    3⤵
    PID:6432
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32580.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32580.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53869.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53869.exe
    3⤵
    PID:1240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8694.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8694.exe
      4⤵
      PID:1804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33640.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33640.exe
      4⤵
      PID:4000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29485.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29485.exe
      4⤵
      PID:4844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2108.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2108.exe
      4⤵
      PID:5852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14397.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14397.exe
    3⤵
    PID:2960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10692.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10692.exe
    3⤵
    PID:4160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35351.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35351.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58980.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58980.exe
    3⤵
    PID:5704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34434.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34434.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6944
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10876.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10876.exe
  2⤵
  PID:2812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39914.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39914.exe
    3⤵
    PID:2372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33640.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33640.exe
    3⤵
    PID:4040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29485.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29485.exe
    3⤵
    PID:4828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56965.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56965.exe
    3⤵
    PID:5228
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3372.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3372.exe
  2⤵
  PID:332
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57321.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57321.exe
  2⤵
  PID:3180
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4550.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4550.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4552
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9108.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9108.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5612
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48435.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48435.exe
  2⤵
  PID:6876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-12134.exe

Filesize
468KB

MD5
913438656119d3ea65899b4000ae9df7

SHA1
88ad940e0a50d562bf1c975c5c0e59c2c6aee2f3

SHA256
6f8b21263c689b1e9f7397baad92c067a7cee4a469be75321c94588e1e5ebc82

SHA512
a1a2c189785e063c4483bea3781a6fe8e64ce46853d780ca19d2d0643035ca0faf924fbd51514ac1120864876676f335148fae625e467df6288817d487219c79

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28816.exe

Filesize
468KB

MD5
038d8a2a32ea7dd9dc512a7559b5f109

SHA1
a3d064593c4bd5fcb0c6187707ff5a21985dfbb6

SHA256
9aa2e628840f191057e49884e002dc264e493e2975b2c7c35be6874a13f9db5f

SHA512
7328c676e823b98ca40c27bd5de925698880b8fe85529aff15713647877bb567cba4fbd09d62c0411a70fe8c367029c355852799687e63e2bd9205caf9408b1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34669.exe

Filesize
468KB

MD5
92a6826084c65485efcca0bdcbce2917

SHA1
39ebfc3f6f1c0c55884a13baf1e09bb2b0a76c8f

SHA256
0f9cf7d0c92de2c490055aa2bf8603b3108342352fe8970a0fe9a1eb45548291

SHA512
0991a9e3ad957590e9e662c284459527e6f2890d349c6574578d1406827f04b23702e9e67082c7b572fdea12d744ecafe75b268cd39692ba97ab61207cf651f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36662.exe

Filesize
468KB

MD5
2508cbce6be15329a4278f1b1ed6f399

SHA1
fcfc91c4b98254eda0066713d321817f8166d688

SHA256
5b89f20bde291113af1db81e92c0bf8ff11beeadc301f9fc1e6585cbea299eca

SHA512
3ce6bfdee316742d58491053d25cd74777b8cc68cd6d7ca75b942cc66a690044c1a1794aff731278675e10985f6554795eaaf8076bfd74a7b2668af70733a1e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60260.exe

Filesize
468KB

MD5
13523141c55dbbcf59467f0fea7e7ad2

SHA1
4add21061a72d3dc060a2de6dbe79f37ee4ad696

SHA256
4759b523e4b25dd38551df2f4040dfd0282335ed576e27799006c6b194f2f85b

SHA512
86e268ab82543355c227a52ce94c47c87aa96fdd9e4cd8328b8b3e29ea60d1dadcc0deb26db25b8b7241a6ffd133b5e8e540c16b1135dbbd4b028049f6ce2233

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-22685.exe

Filesize
468KB

MD5
430b2e7987e01421269cd173edbd9429

SHA1
aaf811752a31b5e4e6304fcce04a402065595385

SHA256
552dd64a0e2b77d799dccbdb80379a719c757c51d02f4d9e416f3fe0aa9c33ec

SHA512
7abf4525fcbe718445d4ac04c7f3e2d097cf5f3d910e9cb87af79b92b91bd167b6e4ae3c1df5ef05b844968a97efde6b1035db6e103e63032d255121afa03f6c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-23184.exe

Filesize
468KB

MD5
61d194373f6190e77c3ce218f784fff9

SHA1
80a769c9092c12a156487e504d1c0fe1800b2e35

SHA256
1deb5f669f5927b5a406d3f936a9f92b9bbcffcdb8c2db3100c54a350387b1bc

SHA512
34176dbfe22eba27b4925d41a22db54d4d0b30e00ab9165ea147a0fbc24ed0f4c9dd7b1777f54567d42ac47fbde6c786f6bfb0475091607e13d55c6e20adea83

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-25521.exe

Filesize
468KB

MD5
c9c7da11a8745756cd45eb8c3e3a2f7f

SHA1
6825d15c8943de0a4694688e9bcd4886c0ea1c23

SHA256
1d48a5f37f124cf48cc49c5afa45f45bf65f8e287828b40ad120689aa6ff6512

SHA512
555c8d3f820d277159be7c0b17f10def673700c328d75ede2e4c63f819706fcd124f6fbec760a1b7bbab912602ce7dcbca397e267ae18af7083bd30eac2f1172

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-29567.exe

Filesize
468KB

MD5
90377f9afdf08fb44dc8841c1ed1eadd

SHA1
d71db1dd21ff09ddbf0d8ada99151ee1a097210b

SHA256
3ac3bebc471c2a3643936b4021c5bd390d3018038a9df277e5c4ddaa93b96ae1

SHA512
0a274841a3159d0618bc221c63e7fc1ae09a604d039807f9c3ae2a36821257fe36ef92b367b584fed99dba06f2bf2c8ab2c1d2eb11cbab3080de9b06fd9fa44c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-34934.exe

Filesize
468KB

MD5
c3fd740f5b688f3cd499f327b0f471d6

SHA1
919abc7a94709c5f656ae83e0b3661dca28048ac

SHA256
12606a97dd7f97b89045b8e602348239fe6d903ae32fdef3dd7c76fc98985c93

SHA512
605fe84f6b9d7c0fc9538b49a5f011a34fc5aa5db5def43a0b8f94f01df84efaad84c98285740e25450d2b1c584be666aaf4eaa93d3aab9be75a12170a62c178

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-42760.exe

Filesize
468KB

MD5
69b1987190fe7a57297a814c35d926d3

SHA1
2f74b53c5d791fdacbfc544165ea26971a6f37b6

SHA256
f394c82eecc22bf4c5bdac39f18dfd22b0b1e7d08387db623257d0b8028cbe9f

SHA512
c6e9dc78aeedf295dfcf9ec3f122e172c3b68778768cfd0c8e8f98fc02847fb2adccf980989661afaf1f4fddf7a0bb87bdd5941de4e697eb84d09ce8cde61fbe

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-48063.exe

Filesize
468KB

MD5
f324d44d8ac9c0de25912434ba3b05cb

SHA1
55735c3277ac50462f9b7491d22e25b2ffa3eb4a

SHA256
c090431040cadd81a80704f3b2e938ad4c44f1f0892669c52fbac9838de5e133

SHA512
3de7e9898d1bed1221995e5d715fac112b025eea004f438a591b1748374316e57529345d4bce314f1a6543426a7deaffc7088fe537f1b9304d8a392f3c79f7a4

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-51883.exe

Filesize
468KB

MD5
d60d708de13a5db54bc7c9198187361f

SHA1
d1aed3856bbaf777898789d7bb75c26e52d55c01

SHA256
af868f72e415f6c0e828c5b8ade481257d3520f558facd9f6f0dc5636f85ed05

SHA512
bcd5f79f9215539af5506ca075a1894ae01e83214829a638e370132363aafadd0b2ad7d42b80edb4fc09ed6a666a26c085e45a7ecc09766dc912686d9e57a0c6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-58013.exe

Filesize
468KB

MD5
bfba4770b345a88e0de47e7c231ce91f

SHA1
7523e9f5440bb382066b8b09d25dacf84a0adadc

SHA256
3eca8bc55d49de7dbca1f20f6a822e24fab961eac67471599d7fb15ce3433def

SHA512
18f181faba2bd18db59ae8b8e9cde9dac59986061c4becbf9ca0f291cdd437ffffca60948864959e92099a6c77c2dd6d19899993dcab40e6340d91ca8b3615d1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-63154.exe

Filesize
468KB

MD5
dd6372f023e9a67b7d774ca13f3c3f71

SHA1
25fcda9a10a2e3cf70a26e7c7cbceadd4497ed2f

SHA256
613cb9e846c7b21f947d1909d5bc5aef2c8c6c47a92e34af328a59c5f07baba8

SHA512
df5684957235ae8e748151d271606841c471b76c35ba9b8c9711ca839e861af6021ed0f6fbcec6384f4093f915704552f7c36a0e04d26122209c2d75a1ffdada

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-64738.exe

Filesize
468KB

MD5
1bf6caaa128cc176459402819491a67f

SHA1
59ff7ac6e87a3092faba8e7c43cff0627e5bb730

SHA256
06f8372702cffc6cce527bae7ecad03712f5d8b8086d49b505ea1decb5be5d64

SHA512
66f34bf7181733f2a28c01e3cf729cff080ec9b428bfdc0d4843f71fcd7dae778c4636124e2ce6afc35e66bf00fbfd40d1b3fd3c737964dffdc4856650f6b1a8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-8106.exe

Filesize
468KB

MD5
90a04d9e7917d490200b26f8f042eef5

SHA1
8cdb523949bd1bcf8eb3ddc42d476a506de4e6c6

SHA256
fe3916a96663aff4367dfcb91fc97b754fc2ef3b5b163deb0e51c7030951fc5a

SHA512
b2bd996e20b1e67cb6065b368e9fcdf7f433d197395591678d8800424188c135ff85ef2eda7215015e712d45415291c2a0daa93e2301c515171832d099a4abf5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-8950.exe

Filesize
468KB

MD5
2c926f5f0bea05d2b8fc7dfa81a59e00

SHA1
33c0db023665cb67e2d0b6a32e68aab946fe3817

SHA256
8a452c3fe2f58c891aebd0cb1c40297c8de78f170d4bfcb86d618e9e90e1139b

SHA512
913c69bdc2352196ecf802cca957944887eb04009ebb08c5e99abba99aa2bc2ec61fe57e33dd190fac18b29df229270e3ec54f4df3a7d876374af19dac163eeb

Download Submit