3258e67c7a4946b8df7159344cfd7338ce4af3ef9eb6c4cef79a89a7b9390674

Analysis

max time kernel
119s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-10-2024 14:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3258e67c7a4946b8df7159344cfd7338ce4af3ef9eb6c4cef79a89a7b9390674N.exe
Size

468KB
MD5

25bc8370354e87eef28445b28182f3e0
SHA1

129cfa24b461d8c6479bd4379c03a0b2451e4218
SHA256

3258e67c7a4946b8df7159344cfd7338ce4af3ef9eb6c4cef79a89a7b9390674
SHA512

29c8bfdeb916d0e7fa40d3cd7b872dc06178a1a1fffcab007ea9cd88a2b9d174c2673c9b6470eded90c5dc253eef778619a3e0a3b0db625f020f85f247679437
SSDEEP

3072:PbO3ogpdIW5UtbfjPhzjff8wgYbMPIpCnmHexVhWiYCL08N664lG:PbuohSUt3P5jffq0oAiYEFN66

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2196	Unicorn-40996.exe
2540	Unicorn-29080.exe
2548	Unicorn-20742.exe
2892	Unicorn-50145.exe
2332	Unicorn-62397.exe
604	Unicorn-42531.exe
2932	Unicorn-56267.exe
2688	Unicorn-2563.exe
2836	Unicorn-23538.exe
1968	Unicorn-23944.exe
2120	Unicorn-40280.exe
1624	Unicorn-34149.exe
2000	Unicorn-52402.exe
1744	Unicorn-6465.exe
1980	Unicorn-51930.exe
2716	Unicorn-57638.exe
1096	Unicorn-44722.exe
2492	Unicorn-1643.exe
788	Unicorn-53445.exe
2064	Unicorn-57166.exe
940	Unicorn-20388.exe
1604	Unicorn-40254.exe
2036	Unicorn-48157.exe
1732	Unicorn-11473.exe
948	Unicorn-27810.exe
900	Unicorn-7944.exe
772	Unicorn-19642.exe
648	Unicorn-46568.exe
2992	Unicorn-43768.exe
2344	Unicorn-13248.exe
1724	Unicorn-47959.exe
2176	Unicorn-25693.exe
2092	Unicorn-8515.exe
1592	Unicorn-54452.exe
2240	Unicorn-25117.exe
2560	Unicorn-47575.exe
3032	Unicorn-17141.exe
2352	Unicorn-46284.exe
2824	Unicorn-612.exe
2624	Unicorn-34437.exe
2264	Unicorn-28306.exe
2752	Unicorn-50773.exe
3028	Unicorn-39075.exe
2692	Unicorn-13943.exe
2680	Unicorn-14208.exe
3060	Unicorn-26461.exe
1108	Unicorn-47436.exe
1680	Unicorn-1764.exe
1924	Unicorn-4395.exe
1908	Unicorn-50067.exe
2424	Unicorn-10103.exe
1940	Unicorn-28900.exe
1296	Unicorn-47658.exe
3048	Unicorn-9226.exe
1348	Unicorn-3626.exe
2928	Unicorn-25008.exe
684	Unicorn-701.exe
824	Unicorn-14483.exe
1864	Unicorn-48095.exe
2980	Unicorn-14675.exe
1816	Unicorn-11146.exe
1676	Unicorn-51167.exe
2288	Unicorn-43264.exe
992	Unicorn-51603.exe

Loads dropped DLL 64 IoCs

pid	Process
2432	3258e67c7a4946b8df7159344cfd7338ce4af3ef9eb6c4cef79a89a7b9390674N.exe
2432	3258e67c7a4946b8df7159344cfd7338ce4af3ef9eb6c4cef79a89a7b9390674N.exe
2432	3258e67c7a4946b8df7159344cfd7338ce4af3ef9eb6c4cef79a89a7b9390674N.exe
2196	Unicorn-40996.exe
2432	3258e67c7a4946b8df7159344cfd7338ce4af3ef9eb6c4cef79a89a7b9390674N.exe
2196	Unicorn-40996.exe
2548	Unicorn-20742.exe
2548	Unicorn-20742.exe
2540	Unicorn-29080.exe
2540	Unicorn-29080.exe
2196	Unicorn-40996.exe
2196	Unicorn-40996.exe
2432	3258e67c7a4946b8df7159344cfd7338ce4af3ef9eb6c4cef79a89a7b9390674N.exe
2432	3258e67c7a4946b8df7159344cfd7338ce4af3ef9eb6c4cef79a89a7b9390674N.exe
2892	Unicorn-50145.exe
2892	Unicorn-50145.exe
2548	Unicorn-20742.exe
2548	Unicorn-20742.exe
604	Unicorn-42531.exe
604	Unicorn-42531.exe
2196	Unicorn-40996.exe
2332	Unicorn-62397.exe
2332	Unicorn-62397.exe
2196	Unicorn-40996.exe
2540	Unicorn-29080.exe
2540	Unicorn-29080.exe
2432	3258e67c7a4946b8df7159344cfd7338ce4af3ef9eb6c4cef79a89a7b9390674N.exe
2432	3258e67c7a4946b8df7159344cfd7338ce4af3ef9eb6c4cef79a89a7b9390674N.exe
2688	Unicorn-2563.exe
2688	Unicorn-2563.exe
2892	Unicorn-50145.exe
2892	Unicorn-50145.exe
2836	Unicorn-23538.exe
2836	Unicorn-23538.exe
2548	Unicorn-20742.exe
2548	Unicorn-20742.exe
2932	Unicorn-56267.exe
2932	Unicorn-56267.exe
1968	Unicorn-23944.exe
1968	Unicorn-23944.exe
604	Unicorn-42531.exe
1624	Unicorn-34149.exe
604	Unicorn-42531.exe
1624	Unicorn-34149.exe
2196	Unicorn-40996.exe
2196	Unicorn-40996.exe
2120	Unicorn-40280.exe
2120	Unicorn-40280.exe
2332	Unicorn-62397.exe
2000	Unicorn-52402.exe
2332	Unicorn-62397.exe
2000	Unicorn-52402.exe
1744	Unicorn-6465.exe
1744	Unicorn-6465.exe
2540	Unicorn-29080.exe
2432	3258e67c7a4946b8df7159344cfd7338ce4af3ef9eb6c4cef79a89a7b9390674N.exe
2540	Unicorn-29080.exe
2432	3258e67c7a4946b8df7159344cfd7338ce4af3ef9eb6c4cef79a89a7b9390674N.exe
2716	Unicorn-57638.exe
2716	Unicorn-57638.exe
2892	Unicorn-50145.exe
2892	Unicorn-50145.exe
1980	Unicorn-51930.exe
1980	Unicorn-51930.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2256	1940	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55296.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10224.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22482.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53445.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3839.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14647.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35369.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37916.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6824.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10179.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19495.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49924.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64245.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26703.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57320.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5947.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28772.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31664.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53631.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43931.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48150.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64040.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22482.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6824.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16321.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50067.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35369.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22482.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7772.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3626.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64889.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18720.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48095.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48223.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27206.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2185.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4395.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3276.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8876.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24871.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64245.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28900.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37801.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42285.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28549.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35115.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22482.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32856.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47081.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28549.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37672.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48150.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12237.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47081.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22949.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37672.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29551.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29551.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32025.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22482.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37438.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19308.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43786.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29303.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2432	3258e67c7a4946b8df7159344cfd7338ce4af3ef9eb6c4cef79a89a7b9390674N.exe
2196	Unicorn-40996.exe
2548	Unicorn-20742.exe
2540	Unicorn-29080.exe
2892	Unicorn-50145.exe
604	Unicorn-42531.exe
2932	Unicorn-56267.exe
2332	Unicorn-62397.exe
2688	Unicorn-2563.exe
2836	Unicorn-23538.exe
1968	Unicorn-23944.exe
2120	Unicorn-40280.exe
1624	Unicorn-34149.exe
2000	Unicorn-52402.exe
1744	Unicorn-6465.exe
1980	Unicorn-51930.exe
2716	Unicorn-57638.exe
1096	Unicorn-44722.exe
2492	Unicorn-1643.exe
788	Unicorn-53445.exe
2064	Unicorn-57166.exe
940	Unicorn-20388.exe
1604	Unicorn-40254.exe
1732	Unicorn-11473.exe
2036	Unicorn-48157.exe
900	Unicorn-7944.exe
948	Unicorn-27810.exe
772	Unicorn-19642.exe
2992	Unicorn-43768.exe
648	Unicorn-46568.exe
2344	Unicorn-13248.exe
1724	Unicorn-47959.exe
2176	Unicorn-25693.exe
2092	Unicorn-8515.exe
1592	Unicorn-54452.exe
2240	Unicorn-25117.exe
2560	Unicorn-47575.exe
3032	Unicorn-17141.exe
2352	Unicorn-46284.exe
2824	Unicorn-612.exe
2624	Unicorn-34437.exe
2264	Unicorn-28306.exe
2752	Unicorn-50773.exe
3028	Unicorn-39075.exe
2680	Unicorn-14208.exe
2692	Unicorn-13943.exe
3060	Unicorn-26461.exe
1680	Unicorn-1764.exe
1108	Unicorn-47436.exe
1924	Unicorn-4395.exe
2424	Unicorn-10103.exe
1908	Unicorn-50067.exe
1940	Unicorn-28900.exe
1296	Unicorn-47658.exe
3048	Unicorn-9226.exe
1348	Unicorn-3626.exe
2928	Unicorn-25008.exe
684	Unicorn-701.exe
1864	Unicorn-48095.exe
824	Unicorn-14483.exe
2980	Unicorn-14675.exe
1816	Unicorn-11146.exe
1676	Unicorn-51167.exe
2288	Unicorn-43264.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 2196	2432	3258e67c7a4946b8df7159344cfd7338ce4af3ef9eb6c4cef79a89a7b9390674N.exe	31
PID 2432 wrote to memory of 2196	2432	3258e67c7a4946b8df7159344cfd7338ce4af3ef9eb6c4cef79a89a7b9390674N.exe	31
PID 2432 wrote to memory of 2196	2432	3258e67c7a4946b8df7159344cfd7338ce4af3ef9eb6c4cef79a89a7b9390674N.exe	31
PID 2432 wrote to memory of 2196	2432	3258e67c7a4946b8df7159344cfd7338ce4af3ef9eb6c4cef79a89a7b9390674N.exe	31
PID 2432 wrote to memory of 2540	2432	3258e67c7a4946b8df7159344cfd7338ce4af3ef9eb6c4cef79a89a7b9390674N.exe	32
PID 2432 wrote to memory of 2540	2432	3258e67c7a4946b8df7159344cfd7338ce4af3ef9eb6c4cef79a89a7b9390674N.exe	32
PID 2432 wrote to memory of 2540	2432	3258e67c7a4946b8df7159344cfd7338ce4af3ef9eb6c4cef79a89a7b9390674N.exe	32
PID 2432 wrote to memory of 2540	2432	3258e67c7a4946b8df7159344cfd7338ce4af3ef9eb6c4cef79a89a7b9390674N.exe	32
PID 2196 wrote to memory of 2548	2196	Unicorn-40996.exe	33
PID 2196 wrote to memory of 2548	2196	Unicorn-40996.exe	33
PID 2196 wrote to memory of 2548	2196	Unicorn-40996.exe	33
PID 2196 wrote to memory of 2548	2196	Unicorn-40996.exe	33
PID 2548 wrote to memory of 2892	2548	Unicorn-20742.exe	34
PID 2548 wrote to memory of 2892	2548	Unicorn-20742.exe	34
PID 2548 wrote to memory of 2892	2548	Unicorn-20742.exe	34
PID 2548 wrote to memory of 2892	2548	Unicorn-20742.exe	34
PID 2540 wrote to memory of 2332	2540	Unicorn-29080.exe	35
PID 2540 wrote to memory of 2332	2540	Unicorn-29080.exe	35
PID 2540 wrote to memory of 2332	2540	Unicorn-29080.exe	35
PID 2540 wrote to memory of 2332	2540	Unicorn-29080.exe	35
PID 2196 wrote to memory of 604	2196	Unicorn-40996.exe	36
PID 2196 wrote to memory of 604	2196	Unicorn-40996.exe	36
PID 2196 wrote to memory of 604	2196	Unicorn-40996.exe	36
PID 2196 wrote to memory of 604	2196	Unicorn-40996.exe	36
PID 2432 wrote to memory of 2932	2432	3258e67c7a4946b8df7159344cfd7338ce4af3ef9eb6c4cef79a89a7b9390674N.exe	37
PID 2432 wrote to memory of 2932	2432	3258e67c7a4946b8df7159344cfd7338ce4af3ef9eb6c4cef79a89a7b9390674N.exe	37
PID 2432 wrote to memory of 2932	2432	3258e67c7a4946b8df7159344cfd7338ce4af3ef9eb6c4cef79a89a7b9390674N.exe	37
PID 2432 wrote to memory of 2932	2432	3258e67c7a4946b8df7159344cfd7338ce4af3ef9eb6c4cef79a89a7b9390674N.exe	37
PID 2892 wrote to memory of 2688	2892	Unicorn-50145.exe	38
PID 2892 wrote to memory of 2688	2892	Unicorn-50145.exe	38
PID 2892 wrote to memory of 2688	2892	Unicorn-50145.exe	38
PID 2892 wrote to memory of 2688	2892	Unicorn-50145.exe	38
PID 2548 wrote to memory of 2836	2548	Unicorn-20742.exe	39
PID 2548 wrote to memory of 2836	2548	Unicorn-20742.exe	39
PID 2548 wrote to memory of 2836	2548	Unicorn-20742.exe	39
PID 2548 wrote to memory of 2836	2548	Unicorn-20742.exe	39
PID 604 wrote to memory of 1968	604	Unicorn-42531.exe	40
PID 604 wrote to memory of 1968	604	Unicorn-42531.exe	40
PID 604 wrote to memory of 1968	604	Unicorn-42531.exe	40
PID 604 wrote to memory of 1968	604	Unicorn-42531.exe	40
PID 2332 wrote to memory of 2120	2332	Unicorn-62397.exe	42
PID 2332 wrote to memory of 2120	2332	Unicorn-62397.exe	42
PID 2332 wrote to memory of 2120	2332	Unicorn-62397.exe	42
PID 2332 wrote to memory of 2120	2332	Unicorn-62397.exe	42
PID 2196 wrote to memory of 1624	2196	Unicorn-40996.exe	41
PID 2196 wrote to memory of 1624	2196	Unicorn-40996.exe	41
PID 2196 wrote to memory of 1624	2196	Unicorn-40996.exe	41
PID 2196 wrote to memory of 1624	2196	Unicorn-40996.exe	41
PID 2540 wrote to memory of 2000	2540	Unicorn-29080.exe	43
PID 2540 wrote to memory of 2000	2540	Unicorn-29080.exe	43
PID 2540 wrote to memory of 2000	2540	Unicorn-29080.exe	43
PID 2540 wrote to memory of 2000	2540	Unicorn-29080.exe	43
PID 2432 wrote to memory of 1744	2432	3258e67c7a4946b8df7159344cfd7338ce4af3ef9eb6c4cef79a89a7b9390674N.exe	44
PID 2432 wrote to memory of 1744	2432	3258e67c7a4946b8df7159344cfd7338ce4af3ef9eb6c4cef79a89a7b9390674N.exe	44
PID 2432 wrote to memory of 1744	2432	3258e67c7a4946b8df7159344cfd7338ce4af3ef9eb6c4cef79a89a7b9390674N.exe	44
PID 2432 wrote to memory of 1744	2432	3258e67c7a4946b8df7159344cfd7338ce4af3ef9eb6c4cef79a89a7b9390674N.exe	44
PID 2688 wrote to memory of 1980	2688	Unicorn-2563.exe	45
PID 2688 wrote to memory of 1980	2688	Unicorn-2563.exe	45
PID 2688 wrote to memory of 1980	2688	Unicorn-2563.exe	45
PID 2688 wrote to memory of 1980	2688	Unicorn-2563.exe	45
PID 2892 wrote to memory of 2716	2892	Unicorn-50145.exe	46
PID 2892 wrote to memory of 2716	2892	Unicorn-50145.exe	46
PID 2892 wrote to memory of 2716	2892	Unicorn-50145.exe	46
PID 2892 wrote to memory of 2716	2892	Unicorn-50145.exe	46

C:\Users\Admin\AppData\Local\Temp\3258e67c7a4946b8df7159344cfd7338ce4af3ef9eb6c4cef79a89a7b9390674N.exe
"C:\Users\Admin\AppData\Local\Temp\3258e67c7a4946b8df7159344cfd7338ce4af3ef9eb6c4cef79a89a7b9390674N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40996.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40996.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20742.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20742.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50145.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50145.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2563.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51930.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25693.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43264.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4258.exe
        9⤵
        
        PID:1316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28212.exe
        9⤵
        
        PID:3308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52763.exe
        9⤵
        
        PID:4260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38678.exe
        9⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8876.exe
        8⤵
        
        PID:3052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29503.exe
        8⤵
        
        PID:3804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7190.exe
        8⤵
        
        PID:4512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22482.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12237.exe
        8⤵
        
        PID:6372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51603.exe
        7⤵
        Executes dropped EXE
        
        PID:992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48223.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15768.exe
        8⤵
        
        PID:4012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1325.exe
        8⤵
        
        PID:4760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51585.exe
        8⤵
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22611.exe
        7⤵
        
        PID:1164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35369.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64062.exe
        7⤵
        
        PID:4684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60319.exe
        7⤵
        
        PID:5156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54452.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47081.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64040.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29551.exe
        8⤵
        
        PID:4940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26159.exe
        8⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37438.exe
        8⤵
        
        PID:6764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28549.exe
        7⤵
        
        PID:2556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37672.exe
        7⤵
        
        PID:3496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7190.exe
        7⤵
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56224.exe
        7⤵
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44909.exe
        7⤵
        
        PID:6560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43666.exe
        6⤵
        
        PID:2696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35110.exe
        7⤵
        
        PID:920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12616.exe
        7⤵
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64245.exe
        7⤵
        
        PID:6600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5717.exe
        6⤵
        
        PID:4020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23951.exe
        6⤵
        
        PID:4928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23012.exe
        6⤵
        
        PID:5380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7772.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57638.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13248.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14483.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24850.exe
        8⤵
        
        PID:1076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15768.exe
        8⤵
        
        PID:3892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1325.exe
        8⤵
        
        PID:4396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32025.exe
        8⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28772.exe
        8⤵
        
        PID:6584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58596.exe
        7⤵
        
        PID:2552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29316.exe
        7⤵
        
        PID:3904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52002.exe
        7⤵
        
        PID:4956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13477.exe
        7⤵
        
        PID:6000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48095.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17969.exe
        7⤵
        
        PID:2788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12426.exe
        8⤵
        
        PID:1564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28212.exe
        8⤵
        
        PID:3204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52763.exe
        8⤵
        
        PID:4244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38678.exe
        8⤵
        
        PID:6056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29701.exe
        7⤵
        
        PID:3152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49924.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7190.exe
        7⤵
        
        PID:4516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22482.exe
        7⤵
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12237.exe
        7⤵
        
        PID:6148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65123.exe
        6⤵
        
        PID:2876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64922.exe
        6⤵
        
        PID:3996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35115.exe
        6⤵
        
        PID:5076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5947.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33387.exe
        6⤵
        
        PID:5396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47959.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14675.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43931.exe
        7⤵
        
        PID:2380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31218.exe
        8⤵
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11739.exe
        8⤵
        
        PID:6072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64245.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37656.exe
        7⤵
        
        PID:3504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49152.exe
        7⤵
        
        PID:4876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23359.exe
        7⤵
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12237.exe
        7⤵
        
        PID:6396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54574.exe
        6⤵
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56635.exe
        7⤵
        
        PID:3268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54802.exe
        7⤵
        
        PID:4968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38678.exe
        7⤵
        
        PID:5992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37656.exe
        6⤵
        
        PID:3556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49152.exe
        6⤵
        
        PID:4836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34734.exe
        6⤵
        
        PID:5520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12237.exe
        6⤵
        
        PID:6296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51167.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44336.exe
        6⤵
        
        PID:1808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41237.exe
        6⤵
        
        PID:3108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37916.exe
        6⤵
        
        PID:2944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32025.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28772.exe
        6⤵
        
        PID:6520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19811.exe
        5⤵
        
        PID:2020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10168.exe
        5⤵
        
        PID:3900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64592.exe
        5⤵
        
        PID:928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1482.exe
        5⤵
        
        PID:5364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2437.exe
        5⤵
        
        PID:6608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23538.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23538.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44722.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26461.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11471.exe
        7⤵
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19308.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29551.exe
        8⤵
        
        PID:4900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27386.exe
        8⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61388.exe
        7⤵
        
        PID:3272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51455.exe
        7⤵
        
        PID:4624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31148.exe
        7⤵
        
        PID:5204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32856.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48783.exe
        6⤵
        
        PID:1920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38960.exe
        7⤵
        
        PID:3564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12063.exe
        7⤵
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25282.exe
        7⤵
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37438.exe
        7⤵
        
        PID:6756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36338.exe
        6⤵
        
        PID:3652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31664.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2185.exe
        6⤵
        
        PID:5936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10103.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26469.exe
        6⤵
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17196.exe
        7⤵
        
        PID:3260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37916.exe
        7⤵
        
        PID:5004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31148.exe
        7⤵
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32856.exe
        7⤵
        
        PID:5336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28549.exe
        6⤵
        
        PID:2728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35115.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5947.exe
        6⤵
        
        PID:5136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29303.exe
        6⤵
        
        PID:6156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37827.exe
        5⤵
        
        PID:2704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5903.exe
        6⤵
        
        PID:3720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10584.exe
        6⤵
        
        PID:5056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26159.exe
        6⤵
        
        PID:5908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37438.exe
        6⤵
        
        PID:6700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48150.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2583.exe
        5⤵
        
        PID:3500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47526.exe
        5⤵
        
        PID:4500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23012.exe
        5⤵
        
        PID:4472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11856.exe
        5⤵
        
        PID:5284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1643.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1643.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11146.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17261.exe
        6⤵
        
        PID:3964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57320.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22482.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12237.exe
        6⤵
        
        PID:6172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22611.exe
        5⤵
        
        PID:584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22998.exe
        5⤵
        
        PID:4132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37659.exe
        5⤵
        
        PID:1492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33387.exe
        5⤵
        
        PID:6088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8515.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8515.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26352.exe
        5⤵
        
        PID:1056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17261.exe
        6⤵
        
        PID:3956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43521.exe
        6⤵
        
        PID:3472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40487.exe
        6⤵
        
        PID:4676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6824.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29303.exe
        6⤵
        
        PID:6328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8876.exe
        5⤵
        
        PID:1132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29503.exe
        5⤵
        
        PID:3836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7190.exe
        5⤵
        
        PID:4484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22482.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16321.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53493.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53493.exe
      4⤵
      PID:2484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23719.exe
        5⤵
        
        PID:560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64777.exe
        5⤵
        
        PID:3768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1325.exe
        5⤵
        
        PID:4616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43400.exe
        5⤵
        
        PID:5500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61445.exe
        5⤵
        
        PID:6552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3276.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3276.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27234.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27234.exe
      4⤵
      PID:3528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43061.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43061.exe
      4⤵
      PID:4812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16227.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16227.exe
      4⤵
      PID:4428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10721.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10721.exe
      4⤵
      PID:348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42531.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42531.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23944.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23944.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57166.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34437.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47081.exe
        7⤵
        
        PID:792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10179.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12063.exe
        8⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26159.exe
        8⤵
        
        PID:5868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37438.exe
        8⤵
        
        PID:6772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28549.exe
        7⤵
        
        PID:1200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54703.exe
        7⤵
        
        PID:3240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49152.exe
        7⤵
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23359.exe
        7⤵
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12237.exe
        7⤵
        
        PID:6412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27215.exe
        6⤵
        
        PID:2420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26900.exe
        7⤵
        
        PID:3128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29551.exe
        7⤵
        
        PID:4740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15407.exe
        7⤵
        
        PID:5132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42285.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35369.exe
        6⤵
        
        PID:3944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64062.exe
        6⤵
        
        PID:4400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6824.exe
        6⤵
        
        PID:5860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29303.exe
        6⤵
        
        PID:6320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39075.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47081.exe
        6⤵
        
        PID:316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43786.exe
        7⤵
        
        PID:3696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37719.exe
        7⤵
        
        PID:4572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25282.exe
        7⤵
        
        PID:4232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37438.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28549.exe
        6⤵
        
        PID:2204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41756.exe
        6⤵
        
        PID:3468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7190.exe
        6⤵
        
        PID:4656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11363.exe
        6⤵
        
        PID:6092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30169.exe
        5⤵
        
        PID:2636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18320.exe
        5⤵
        
        PID:3488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49185.exe
        5⤵
        
        PID:4564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1482.exe
        5⤵
        
        PID:5228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2437.exe
        5⤵
        
        PID:6616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20388.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20388.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-612.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18459.exe
        6⤵
        
        PID:2832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25940.exe
        7⤵
        
        PID:3188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64969.exe
        7⤵
        
        PID:3232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52763.exe
        7⤵
        
        PID:4264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38678.exe
        7⤵
        
        PID:5984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8876.exe
        6⤵
        
        PID:2600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29503.exe
        6⤵
        
        PID:3948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7190.exe
        6⤵
        
        PID:4648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22482.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12237.exe
        6⤵
        
        PID:6196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63554.exe
        5⤵
        
        PID:2748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42468.exe
        6⤵
        
        PID:3668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12063.exe
        6⤵
        
        PID:4324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27386.exe
        6⤵
        
        PID:5976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22611.exe
        5⤵
        
        PID:2684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35369.exe
        5⤵
        
        PID:3104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64062.exe
        5⤵
        
        PID:4560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18199.exe
        5⤵
        
        PID:5648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61975.exe
        5⤵
        
        PID:6544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28306.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28306.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47081.exe
        5⤵
        
        PID:2856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23200.exe
        6⤵
        
        PID:3872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29551.exe
        6⤵
        
        PID:4732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26159.exe
        6⤵
        
        PID:5900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37438.exe
        6⤵
        
        PID:6716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28549.exe
        5⤵
        
        PID:2512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5383.exe
        5⤵
        
        PID:3772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7190.exe
        5⤵
        
        PID:4780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2185.exe
        5⤵
        
        PID:5952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18035.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18035.exe
      4⤵
      PID:1620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43786.exe
        5⤵
        
        PID:3580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41803.exe
        5⤵
        
        PID:4528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25282.exe
        5⤵
        
        PID:4312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41522.exe
        5⤵
        
        PID:6032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39485.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39485.exe
      4⤵
      PID:1784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10168.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10168.exe
      4⤵
      PID:3796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21562.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21562.exe
      4⤵
      PID:4152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4445.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4445.exe
      4⤵
      PID:6132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34149.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34149.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40254.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40254.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17141.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44336.exe
        6⤵
        
        PID:1800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41237.exe
        6⤵
        
        PID:2340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37916.exe
        6⤵
        
        PID:1344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18720.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19234.exe
        5⤵
        
        PID:2884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27206.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35115.exe
        5⤵
        
        PID:5112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5947.exe
        5⤵
        
        PID:5192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46284.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46284.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47081.exe
        5⤵
        
        PID:1452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5135.exe
        6⤵
        
        PID:3332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12063.exe
        6⤵
        
        PID:4288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37535.exe
        6⤵
        
        PID:5528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37438.exe
        6⤵
        
        PID:6780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28549.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37672.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7190.exe
        5⤵
        
        PID:4436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22482.exe
        5⤵
        
        PID:5328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12237.exe
        5⤵
        
        PID:6288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40951.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40951.exe
      4⤵
      PID:1640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26900.exe
        5⤵
        
        PID:3116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29551.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27386.exe
        5⤵
        
        PID:6028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48150.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48150.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26703.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26703.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47526.exe
      4⤵
      PID:4756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63257.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63257.exe
      4⤵
      PID:5600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48157.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48157.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25008.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25008.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47081.exe
        5⤵
        
        PID:1976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43786.exe
        6⤵
        
        PID:3588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29551.exe
        6⤵
        
        PID:4884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34519.exe
        6⤵
        
        PID:5312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4573.exe
        6⤵
        
        PID:6692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28549.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37672.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7190.exe
        5⤵
        
        PID:4424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23359.exe
        5⤵
        
        PID:5760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12237.exe
        5⤵
        
        PID:6356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37801.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37801.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44788.exe
        5⤵
        
        PID:4224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12616.exe
        5⤵
        
        PID:6096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64245.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34855.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34855.exe
      4⤵
      PID:3512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11699.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11699.exe
      4⤵
      PID:4520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23012.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23012.exe
      4⤵
      PID:4788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11856.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11856.exe
      4⤵
      PID:5308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-701.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-701.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56396.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56396.exe
      4⤵
      PID:2912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-184.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-184.exe
      4⤵
      PID:3760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51455.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51455.exe
      4⤵
      PID:4580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64889.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64889.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61445.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61445.exe
      4⤵
      PID:6592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18870.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18870.exe
    3⤵
    PID:1212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43786.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43786.exe
      4⤵
      PID:3612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29551.exe
      4⤵
      PID:4716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26159.exe
      4⤵
      PID:5916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37438.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37438.exe
      4⤵
      PID:6724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35386.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35386.exe
    3⤵
    PID:3540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27654.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27654.exe
    3⤵
    PID:4604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61684.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61684.exe
    3⤵
    PID:5124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6637.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6637.exe
    3⤵
    PID:6164
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29080.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29080.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62397.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62397.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40280.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40280.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11473.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28900.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1940
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 200
        7⤵
        Program crash
        
        PID:2256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24470.exe
        6⤵
        
        PID:1548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25232.exe
        6⤵
        
        PID:4036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43781.exe
        6⤵
        
        PID:2700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23359.exe
        6⤵
        
        PID:5776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12237.exe
        6⤵
        
        PID:6340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9226.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28742.exe
        6⤵
        
        PID:2852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15768.exe
        6⤵
        
        PID:3860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1325.exe
        6⤵
        
        PID:4376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32025.exe
        6⤵
        
        PID:5752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28772.exe
        6⤵
        
        PID:6496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6109.exe
        5⤵
        
        PID:688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57823.exe
        5⤵
        
        PID:3172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35115.exe
        5⤵
        
        PID:5068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6824.exe
        5⤵
        
        PID:5844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29303.exe
        5⤵
        
        PID:6256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7944.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7944.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4395.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12031.exe
        6⤵
        
        PID:1656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34492.exe
        7⤵
        
        PID:3816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29551.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25282.exe
        7⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37438.exe
        7⤵
        
        PID:6740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42285.exe
        6⤵
        
        PID:2476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35369.exe
        6⤵
        
        PID:4092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64062.exe
        6⤵
        
        PID:4540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39688.exe
        6⤵
        
        PID:5492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29303.exe
        6⤵
        
        PID:6280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27215.exe
        5⤵
        
        PID:1792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36526.exe
        6⤵
        
        PID:2888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10224.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15097.exe
        7⤵
        
        PID:6908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15768.exe
        6⤵
        
        PID:3852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1325.exe
        6⤵
        
        PID:4416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31148.exe
        6⤵
        
        PID:5244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32856.exe
        6⤵
        
        PID:6064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52352.exe
        5⤵
        
        PID:1664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35369.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64062.exe
        5⤵
        
        PID:4352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6824.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29303.exe
        5⤵
        
        PID:6388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47658.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47658.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57522.exe
        5⤵
        
        PID:2072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29503.exe
        5⤵
        
        PID:4084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7190.exe
        5⤵
        
        PID:4692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2185.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44071.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44071.exe
      4⤵
      PID:1336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61290.exe
        5⤵
        
        PID:3256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38983.exe
        5⤵
        
        PID:4336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31572.exe
        5⤵
        
        PID:6488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52173.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52173.exe
      4⤵
      PID:2620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18580.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18580.exe
      4⤵
      PID:5084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35265.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35265.exe
      4⤵
      PID:5508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7772.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7772.exe
      4⤵
      PID:6468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52402.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52402.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27810.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27810.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14208.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47081.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10563.exe
        7⤵
        
        PID:4072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29551.exe
        7⤵
        
        PID:4828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27386.exe
        7⤵
        
        PID:5696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28549.exe
        6⤵
        
        PID:372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21335.exe
        6⤵
        
        PID:3184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7190.exe
        6⤵
        
        PID:4696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16313.exe
        6⤵
        
        PID:5268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27215.exe
        5⤵
        
        PID:1936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19495.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24180.exe
        6⤵
        
        PID:5100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27386.exe
        6⤵
        
        PID:5972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42285.exe
        5⤵
        
        PID:1068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11248.exe
        5⤵
        
        PID:3576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64062.exe
        5⤵
        
        PID:4772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5947.exe
        5⤵
        
        PID:2292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29303.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47436.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48041.exe
        5⤵
        
        PID:2016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5135.exe
        6⤵
        
        PID:3340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37916.exe
        6⤵
        
        PID:5024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26312.exe
        6⤵
        
        PID:6116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28549.exe
        5⤵
        
        PID:2124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35466.exe
        5⤵
        
        PID:4816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30543.exe
        5⤵
        
        PID:5964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37801.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37801.exe
      4⤵
      PID:2372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43786.exe
        5⤵
        
        PID:3632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29551.exe
        5⤵
        
        PID:4844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26159.exe
        5⤵
        
        PID:5812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42866.exe
        5⤵
        
        PID:6880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14382.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14382.exe
      4⤵
      PID:4056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40487.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40487.exe
      4⤵
      PID:4820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19250.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19250.exe
      4⤵
      PID:5596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46568.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46568.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50773.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50773.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43931.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63656.exe
        6⤵
        
        PID:3136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29551.exe
        6⤵
        
        PID:4792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26159.exe
        6⤵
        
        PID:5820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37438.exe
        6⤵
        
        PID:6748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60319.exe
        5⤵
        
        PID:4028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43287.exe
        5⤵
        
        PID:4916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32025.exe
        5⤵
        
        PID:5712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28772.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22445.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22445.exe
      4⤵
      PID:884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53739.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53739.exe
      4⤵
      PID:3212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35115.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35115.exe
      4⤵
      PID:5092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6824.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6824.exe
      4⤵
      PID:5828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29303.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29303.exe
      4⤵
      PID:6428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13943.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13943.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47081.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47081.exe
      4⤵
      PID:2520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22240.exe
        5⤵
        
        PID:3776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29551.exe
        5⤵
        
        PID:4708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26159.exe
        5⤵
        
        PID:5924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37438.exe
        5⤵
        
        PID:6708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28549.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28549.exe
      4⤵
      PID:1208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41756.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41756.exe
      4⤵
      PID:3168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7190.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7190.exe
      4⤵
      PID:4464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23359.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23359.exe
      4⤵
      PID:5736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12237.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12237.exe
      4⤵
      PID:6348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38151.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38151.exe
    3⤵
    PID:1708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43786.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43786.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29551.exe
      4⤵
      PID:4860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27386.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27386.exe
      4⤵
      PID:5688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22949.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22949.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3113.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3113.exe
    3⤵
    PID:3536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43061.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43061.exe
    3⤵
    PID:4892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29888.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29888.exe
    3⤵
    PID:5472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6637.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6637.exe
    3⤵
    PID:6308
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56267.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56267.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53445.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53445.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25117.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25117.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30628.exe
        5⤵
        
        PID:1456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-174.exe
        6⤵
        
        PID:3080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36188.exe
        6⤵
        
        PID:3688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1325.exe
        6⤵
        
        PID:4368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31148.exe
        6⤵
        
        PID:5180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32856.exe
        6⤵
        
        PID:2268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8876.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29503.exe
        5⤵
        
        PID:4052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7190.exe
        5⤵
        
        PID:4652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22482.exe
        5⤵
        
        PID:1916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12237.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43517.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43517.exe
      4⤵
      PID:2200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51212.exe
        5⤵
        
        PID:3596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37916.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31148.exe
        5⤵
        
        PID:5160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28772.exe
        5⤵
        
        PID:6512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22611.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22611.exe
      4⤵
      PID:2924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35369.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35369.exe
      4⤵
      PID:3936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64062.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64062.exe
      4⤵
      PID:4348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5947.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5947.exe
      4⤵
      PID:4248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29303.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29303.exe
      4⤵
      PID:6272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47575.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47575.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63383.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63383.exe
      4⤵
      PID:2084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28742.exe
        5⤵
        
        PID:1528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23920.exe
        6⤵
        
        PID:3476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43781.exe
        6⤵
        
        PID:2580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23359.exe
        6⤵
        
        PID:5792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12237.exe
        6⤵
        
        PID:6404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56043.exe
        5⤵
        
        PID:3516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25798.exe
        5⤵
        
        PID:4196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32025.exe
        5⤵
        
        PID:5704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28772.exe
        5⤵
        
        PID:6576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8876.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8876.exe
      4⤵
      PID:2976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29503.exe
      4⤵
      PID:3824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7190.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7190.exe
      4⤵
      PID:4468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22482.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22482.exe
      4⤵
      PID:5220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16321.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16321.exe
      4⤵
      PID:5272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2926.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2926.exe
    3⤵
    PID:2820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14647.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29551.exe
      4⤵
      PID:4852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15783.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15783.exe
      4⤵
      PID:5260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19811.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19811.exe
    3⤵
    PID:2916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10168.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10168.exe
    3⤵
    PID:4040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64592.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64592.exe
    3⤵
    PID:4552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25249.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25249.exe
    3⤵
    PID:5296
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6465.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6465.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19642.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19642.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1764.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1764.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34411.exe
        5⤵
        
        PID:2880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48970.exe
        6⤵
        
        PID:2108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15768.exe
        6⤵
        
        PID:3812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1325.exe
        6⤵
        
        PID:4384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32025.exe
        6⤵
        
        PID:5728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28772.exe
        6⤵
        
        PID:6528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8876.exe
        5⤵
        
        PID:1020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29503.exe
        5⤵
        
        PID:3800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7190.exe
        5⤵
        
        PID:4356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22482.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12237.exe
        5⤵
        
        PID:6380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28141.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28141.exe
      4⤵
      PID:2408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43786.exe
        5⤵
        
        PID:3604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29551.exe
        5⤵
        
        PID:4868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59024.exe
        5⤵
        
        PID:5624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37438.exe
        5⤵
        
        PID:6796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22611.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22611.exe
      4⤵
      PID:1440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35369.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35369.exe
      4⤵
      PID:4016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64062.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64062.exe
      4⤵
      PID:4408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52115.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52115.exe
      4⤵
      PID:5388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50067.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50067.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43923.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43923.exe
      4⤵
      PID:2364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19308.exe
        5⤵
        
        PID:3984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29551.exe
        5⤵
        
        PID:4724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26159.exe
        5⤵
        
        PID:5876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37438.exe
        5⤵
        
        PID:6732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8876.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8876.exe
      4⤵
      PID:2960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29503.exe
      4⤵
      PID:3848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7190.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7190.exe
      4⤵
      PID:4448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23359.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23359.exe
      4⤵
      PID:5784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12237.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12237.exe
      4⤵
      PID:6364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40951.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40951.exe
    3⤵
    PID:1760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43786.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43786.exe
      4⤵
      PID:3740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29551.exe
      4⤵
      PID:4908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27386.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27386.exe
      4⤵
      PID:6012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48150.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48150.exe
    3⤵
    PID:2400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6463.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6463.exe
    3⤵
    PID:4212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23012.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23012.exe
    3⤵
    PID:5372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7772.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7772.exe
    3⤵
    PID:6460
- C:\Users\Admin\AppData\Local\Temp\Unicorn-43768.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-43768.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40951.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40951.exe
    3⤵
    PID:1748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41700.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41700.exe
      4⤵
      PID:3292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12063.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12063.exe
      4⤵
      PID:4296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26159.exe
      4⤵
      PID:5892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37438.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37438.exe
      4⤵
      PID:6788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48150.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48150.exe
    3⤵
    PID:1496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18535.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18535.exe
    3⤵
    PID:4080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47526.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47526.exe
    3⤵
    PID:4612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56754.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56754.exe
    3⤵
    PID:5544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40444.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40444.exe
    3⤵
    PID:6676
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3626.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3626.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24871.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24871.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3708.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3708.exe
    3⤵
    PID:3144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52763.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52763.exe
    3⤵
    PID:4276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38678.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38678.exe
    3⤵
    PID:6040
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3839.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3839.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55296.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55296.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12063.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12063.exe
    3⤵
    PID:4316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27386.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27386.exe
    3⤵
    PID:6020
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41509.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41509.exe
  2⤵
  PID:3748
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34763.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34763.exe
  2⤵
  PID:4452
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53631.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53631.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5344
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40354.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40354.exe
  2⤵
  PID:6568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-20742.exe

Filesize
468KB

MD5
a427b4623763bbb502d3461fd1a04175

SHA1
534faca68791c990ac8054654753ff8c1a1a97ff

SHA256
131aeeed97d95695695f95d1d9cf6d72420f537df4fcebd17c822a5ac9a4e4bf

SHA512
2cbd41bd7434b07e6166ae5e8cc7d03b282c8f9fdccdc1661b4e67446ac6ac1727dd1aeed5b9fdc1630b6e913ee97ccf0567aef7c66cbdfeadc09a37e278c822

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23538.exe

Filesize
468KB

MD5
b97852b97fcfbce4296d48db7b005a4a

SHA1
1530b4308f8a5f2caddc532012bde40dbda1a09d

SHA256
ba256100141a23dcde73096bc284e56ee5dd0fcbe60b19922aaaf02b8b253346

SHA512
dfe153cf16ea9fa91e5676039bed619ec547411cbac855f5d26188d8c1515ec4e8319de390326a14de12c2fb0f7717ec395fcc6b736dabc270625d3f51740390

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27654.exe

Filesize
468KB

MD5
3844e73dab1763e74b95cd090f4adbf0

SHA1
05f3cb40ac386d740ee4f3aa8e671fe2df383b56

SHA256
4e55b5c299815749c45efb41a5c21ff2cbc4c12192734de0b71b6dbe4167d29f

SHA512
cae6af57400991b1bf35ef6186b84b50986ce89ea4013c95d3f8443ba36116a994804b8e48901805572f127ecbf5d0e1f73555472e11ba7615889d9b5f558f6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34149.exe

Filesize
468KB

MD5
29eb447c6d6d1ff9787719faa4091f20

SHA1
6ab0b44b45fd09e8d0f9ac51fbb4e1b291bde970

SHA256
1d73cca785cc9ee70306e34c14be976a5d914f7a573d4b0a9e993289290284ba

SHA512
42dee52b4761d03f8997dc07930aac5e48c66f74f8921b1c0159ca424af8a5426c2d6aabceb04d67f77181edf4b2c7b73cc56dbd6cb754ffc5084ec0abee150d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44722.exe

Filesize
468KB

MD5
3bd37eb2b330582965429f0ab5e0ece5

SHA1
484fc82c23c7929d71c24d82971bb6748564275f

SHA256
0f7e5e11f4311ef97d7262a038f52911a63dd6e8f316731903b0cb1eef6cc657

SHA512
f0bb82913def798b81ad3268ee7f060323c745a8b89f4fb7e78ccb7a35642d4801cb49e8464609be3d9a739b4dc8df8446f7c659bc859b6b7be4e3f7f39f0a17

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50145.exe

Filesize
468KB

MD5
efd026564f203662c31c3ad2d25b4495

SHA1
9328cdddc85efef615682e9d04da4caa4fff1b41

SHA256
85a4f04c2f49cb51425086092ce4a3f5ae97324596e34dec1d97e0d36965b5b6

SHA512
ba502abbabd9fa6daea54b51f8455ac2810fc2931f196f0075dbffc78081af077046ccc4d383339ff0a5b44fa6fdca5a661e428e2393f30614d493d40d23aaa9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51930.exe

Filesize
468KB

MD5
5e7a670120040c349dd978b822876c11

SHA1
53d1fd83d3d41205ebcf78aa2be3a7f25752c508

SHA256
acf5e0896c147b0526f5cc674d07897f3e5b2bdaf8b81d7da54ea91292fecb6b

SHA512
354f712601b3f1895e448ed42100fe1aa991b46e29b491c74f59d568497a270c2bdd3bbc7c584c358fe68d41be0ac422ec5b580fea72c2e88f42ceed290b9ed5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56267.exe

Filesize
468KB

MD5
02c01861fcd0842e33252ebaca53a814

SHA1
28ee287c84aaa9facbb24d35bdc5f8ad80c36183

SHA256
24a4bb7327a81bfc09ae71fe980e0bc3d4577312c0ce5c495f2f8ec5ce0a8baf

SHA512
e1c0f169cff9c817c2ea31bd8685f43690ccd1dfa21c6564ec960aee7228e31777c6494e328179574431d878e6533da38f8f31ad674a902b1715d012cfcdf8e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57638.exe

Filesize
468KB

MD5
fbad7a9ea9658ec82510c6117ae54a52

SHA1
845487ae5d59c7fede3c5d167ddb9ecbdc334444

SHA256
992e2b82405163c37528d739e24d4020000cc9ed4855f4e7986b4a13ffa7efde

SHA512
a5fcfb9db8ba09268567cf4236fc6340c237dab804b98c0b1f230426f7d6fffe78fa7afe785577ee2b3ce13c2c43f697265d2111e0399cfaccd95e9d1485ee14

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5903.exe

Filesize
468KB

MD5
554900eda3945702052a9e30b572874e

SHA1
79f82f8860ac064fa471a5e625d1fe71617a1896

SHA256
013b582be56bd470bb1bc3660e7e3e92fc7081e28cec3d10e13dbde2ef3d9e9b

SHA512
1680dd489d4c378b5339cdce17f20554c95d9d3003b35c77ecc9ab52a5f0d391cc80015cbfad314362106544806a19bfda5730aa53a77b9e0de6562ab4d6ca79

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6465.exe

Filesize
468KB

MD5
8a94c1a2c0ae4aa97101ff5f24ddd323

SHA1
1f16e0ebc6e64f8668ecf95d98070095c00a588c

SHA256
2f3e41a56762e25c7dcc74a2bee68e613dc1334d03a1053685e92e23e45ce6d6

SHA512
d0bdcef8238a1e990e4a4c4cc9b2a8333952beaf205ff07fcbed0526d724558720c00191ea8568533ca07582eb20cedd2af2a27bc2fd93bac6a1f9ab701199a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-701.exe

Filesize
468KB

MD5
f71214d50dc22466446dcd4079000b98

SHA1
f5af20ebad30b8a5c89f5c6da19623ecd4110cbc

SHA256
0a4d79bb7bf548fb5d2b964412cebe669878f56ba7da1e8c91559a3fa7d6c715

SHA512
d2edc560a7bf7f0b5a15e9037533400d9433a6ae3027556b2579e194458b0aea5938546f6c4ab4ffb28e0d84a9c72a9517bc478821d9c1f4ed53c3e8d4cd368b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-1643.exe

Filesize
468KB

MD5
a9d4cb2cf73f9889ac7561f9f9b6537b

SHA1
aac09d46cb1a202c4fc088e7a57a83994cd17dc3

SHA256
3f3394d1e7a5c0b87df9b2a3d12017f3df971f48e9f4423da2611e429482edca

SHA512
e59dc9f6168032f7f47232b0522b82d21fabf77f4f5cdce935c8e21e30d70a3fd080c31ae1e4250617d099c28d519a6c1e1947f4a6ad569b879ebfb1b076c6f4

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-23944.exe

Filesize
468KB

MD5
00b20b3bf610acb5ee4ad9ff43e6d696

SHA1
0cba3fb305ec05f00beae6a84d0a36575bb0a834

SHA256
7a5d07abbed331ca36391f0349baa60f4e3587d24d52e6f827d7dc0b5fb76751

SHA512
33e4ae35748c528ebde0f5b951ef9d2a82af03974394488e6f3915ac201fc8d15c0403ba7fdb9d50b9ac63a54c37dd08411c79de7a0e80ab0aa2255bf67d0491

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-2563.exe

Filesize
468KB

MD5
ef362739b363a71a6df9a3a89d5b68e4

SHA1
0430ad3920aaf5d2ca0fb35819420f8710365c31

SHA256
970ba64024c05be548e9672643f69c03f12e48b55065734e6e5b2eb4be0f0f60

SHA512
da39312b437112ffda68543722c7a65b245db10e7e28e9c0c1edc14035ec2687a2a6243a1ebdd59e0f15bbfe974694067a63d710f5d3c4c46b6d7b2522cdc882

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-29080.exe

Filesize
468KB

MD5
2173d67bbeda803ed205f1a82f5a4cf4

SHA1
6d387694af4c27ad12dbd1dfea10cc62853dddd5

SHA256
748e21b66178a93983092bc1e252d43c60bd897f99abe2240b6a7f0c2d3b0bcf

SHA512
a7fa156dc050f3644791723cef116924c352507e385f16be4c7f3128474388246487ae05aca8de1bebd155a2476c1eb35ca823a200ec0062b9821d0e1e0b14b7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-40280.exe

Filesize
468KB

MD5
9274042317c4c2729377d3a290da0464

SHA1
9f02c155850d13e8b65c555adb8caba39928d905

SHA256
f0bb8988435859eeee5b9889b7a156e717eb15760a9fcb3be57c5b9ceecfe572

SHA512
a2cbba9ee65946daa0679c6fe2530f754a24ad166bd49eb8395fc2ce09bb0c4afeebb50c18806b65f4d7512dd3b3f25e6ee19dcb678a18f9c307ed66353a04eb

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-40996.exe

Filesize
468KB

MD5
f1df17762795787c5da46744197b2662

SHA1
553aba980aecc5650d41c81b17281a1571013381

SHA256
17cf147dc7b57d7d55f7bc7d7922a4347159047dbdeaeda049fce028bb8eeaa8

SHA512
22e5d432924f3be3e854ccdc4cc8cb3c803f249f9c6b6679a9f563161abc02292213c3410d1668035a59d6454035ec761584df414e4790420dfd18e970d5839c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-42531.exe

Filesize
468KB

MD5
e070841a34ecac63f0f2c9fd4cab1539

SHA1
61b59387aee36edaf4c124e1cbe3fa8edc4b39fa

SHA256
ea34cef46906d0a7484c7c5283fb10d15c69541d94c92926ccf7639cf0a4d13e

SHA512
1ec3f48c0ea28507832e65382594b6d95d174cecd3cd3202ac7626e57f18628bee53704284185971f74e04cb73e11b7d78b7fe7c18b22e488ff9fe6e2a16e29c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-52402.exe

Filesize
468KB

MD5
0ede82fc1f58dcf8ab5f8d068153219c

SHA1
d0b7f92e77749c1bbd80207a88db813f8d35a0d4

SHA256
a30e127120680df042e4b1e5b08e5d0fd2acb019bc73fe7e7fdff845aaa9064f

SHA512
57e29c56ce98d7cb96937ae79308947110ffc98211514594b756a97b5d79092a0dedcefa32524b60b1b29b80afa048cc1173046c88e088494e42c1aea7a65e46

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-62397.exe

Filesize
468KB

MD5
0343e6cd3f45f4c48ccf5d7dd2aa8538

SHA1
563468491a8cfc6417fa520923a48b83b3d4877f

SHA256
8161a2200e7f49e93d7ed8a822fb53cca06e8cfdc68b034f923258d1a43caa6d

SHA512
6a3aa8500f6d39b63093969a74bd36caec26c9c57ec788a7d65eae09e11edc9810affe00acbb7393f0e3c922e11021f53e6b16894072a35c70337884ec8dab5f

Download Submit