dbac323d43d9e83b48c7d29806c68a49f3a7e99889f0e446051a331b7e9f12f2

Analysis

max time kernel
113s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
06/10/2024, 00:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dbac323d43d9e83b48c7d29806c68a49f3a7e99889f0e446051a331b7e9f12f2N.exe
Size

468KB
MD5

71bee573a4caf0c22cde85f34ce195e0
SHA1

8ce4dfb4852e30b221495cdbf1bb3182ba61336b
SHA256

dbac323d43d9e83b48c7d29806c68a49f3a7e99889f0e446051a331b7e9f12f2
SHA512

86f4df3e84a168d6a9aa816a8cffc17c511506dc6d562bc6b49b71edd02ae9368abeae6e09739ce97db7c9de6729f42dfbec1c81d5dc44377b23aac546b2171a
SSDEEP

3072:VPrjovOWI35vtbYZJg+AOfDVrrCdkqIpXlmHeVSwtvwUvuDU9SlKi:VP3oIJvtmJTAOfW0XfvwqgU9S

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2784	Unicorn-46680.exe
2168	Unicorn-46769.exe
2708	Unicorn-32016.exe
2812	Unicorn-10125.exe
2592	Unicorn-53087.exe
3008	Unicorn-41620.exe
1076	Unicorn-54261.exe
644	Unicorn-37851.exe
2672	Unicorn-61680.exe
2172	Unicorn-43419.exe
1156	Unicorn-12204.exe
2564	Unicorn-32070.exe
2484	Unicorn-26899.exe
2876	Unicorn-51535.exe
1452	Unicorn-46230.exe
1992	Unicorn-39109.exe
2424	Unicorn-59447.exe
2352	Unicorn-26905.exe
2164	Unicorn-21350.exe
1212	Unicorn-56915.exe
1112	Unicorn-44746.exe
1628	Unicorn-18026.exe
1868	Unicorn-49249.exe
1084	Unicorn-55379.exe
1720	Unicorn-23344.exe
944	Unicorn-25421.exe
2024	Unicorn-51518.exe
1712	Unicorn-51783.exe
2400	Unicorn-63412.exe
2516	Unicorn-10460.exe
2980	Unicorn-27674.exe
2064	Unicorn-49756.exe
1800	Unicorn-35444.exe
2072	Unicorn-21844.exe
2796	Unicorn-42705.exe
1596	Unicorn-36575.exe
2700	Unicorn-10094.exe
2472	Unicorn-58958.exe
2688	Unicorn-6861.exe
2648	Unicorn-6026.exe
2628	Unicorn-3950.exe
3012	Unicorn-23816.exe
3020	Unicorn-22856.exe
296	Unicorn-14603.exe
3028	Unicorn-40069.exe
2116	Unicorn-19260.exe
2204	Unicorn-32124.exe
1188	Unicorn-10987.exe
1952	Unicorn-22332.exe
1368	Unicorn-16201.exe
3000	Unicorn-54838.exe
1792	Unicorn-2430.exe
1940	Unicorn-27292.exe
2956	Unicorn-51933.exe
2308	Unicorn-58751.exe
2448	Unicorn-7967.exe
1880	Unicorn-30364.exe
1016	Unicorn-21548.exe
2208	Unicorn-35284.exe
1528	Unicorn-21548.exe
1732	Unicorn-21548.exe
1612	Unicorn-41414.exe
1808	Unicorn-41414.exe
1384	Unicorn-41414.exe

Loads dropped DLL 64 IoCs

pid	Process
2160	dbac323d43d9e83b48c7d29806c68a49f3a7e99889f0e446051a331b7e9f12f2N.exe
2160	dbac323d43d9e83b48c7d29806c68a49f3a7e99889f0e446051a331b7e9f12f2N.exe
2784	Unicorn-46680.exe
2160	dbac323d43d9e83b48c7d29806c68a49f3a7e99889f0e446051a331b7e9f12f2N.exe
2160	dbac323d43d9e83b48c7d29806c68a49f3a7e99889f0e446051a331b7e9f12f2N.exe
2784	Unicorn-46680.exe
2168	Unicorn-46769.exe
2168	Unicorn-46769.exe
2160	dbac323d43d9e83b48c7d29806c68a49f3a7e99889f0e446051a331b7e9f12f2N.exe
2160	dbac323d43d9e83b48c7d29806c68a49f3a7e99889f0e446051a331b7e9f12f2N.exe
2708	Unicorn-32016.exe
2708	Unicorn-32016.exe
2784	Unicorn-46680.exe
2784	Unicorn-46680.exe
2812	Unicorn-10125.exe
2812	Unicorn-10125.exe
2168	Unicorn-46769.exe
2168	Unicorn-46769.exe
3008	Unicorn-41620.exe
3008	Unicorn-41620.exe
2708	Unicorn-32016.exe
2708	Unicorn-32016.exe
2592	Unicorn-53087.exe
2592	Unicorn-53087.exe
2784	Unicorn-46680.exe
2784	Unicorn-46680.exe
2160	dbac323d43d9e83b48c7d29806c68a49f3a7e99889f0e446051a331b7e9f12f2N.exe
2160	dbac323d43d9e83b48c7d29806c68a49f3a7e99889f0e446051a331b7e9f12f2N.exe
644	Unicorn-37851.exe
644	Unicorn-37851.exe
2812	Unicorn-10125.exe
2812	Unicorn-10125.exe
1076	Unicorn-54261.exe
1076	Unicorn-54261.exe
2672	Unicorn-61680.exe
2672	Unicorn-61680.exe
2168	Unicorn-46769.exe
2168	Unicorn-46769.exe
2876	Unicorn-51535.exe
2876	Unicorn-51535.exe
1156	Unicorn-12204.exe
1156	Unicorn-12204.exe
2160	dbac323d43d9e83b48c7d29806c68a49f3a7e99889f0e446051a331b7e9f12f2N.exe
2160	dbac323d43d9e83b48c7d29806c68a49f3a7e99889f0e446051a331b7e9f12f2N.exe
2708	Unicorn-32016.exe
2708	Unicorn-32016.exe
2172	Unicorn-43419.exe
2172	Unicorn-43419.exe
3008	Unicorn-41620.exe
3008	Unicorn-41620.exe
2484	Unicorn-26899.exe
2484	Unicorn-26899.exe
2564	Unicorn-32070.exe
2784	Unicorn-46680.exe
2784	Unicorn-46680.exe
2564	Unicorn-32070.exe
2592	Unicorn-53087.exe
2592	Unicorn-53087.exe
1452	Unicorn-46230.exe
1452	Unicorn-46230.exe
1992	Unicorn-39109.exe
1992	Unicorn-39109.exe
2812	Unicorn-10125.exe
2812	Unicorn-10125.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1160	2400	WerFault.exe	58

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56577.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37254.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53495.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13680.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39143.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39143.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46164.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64671.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37254.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53417.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47825.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29780.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12566.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27257.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10777.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54042.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52441.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65108.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6798.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37254.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14513.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24623.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41841.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37845.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56577.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13585.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6026.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39181.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30477.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46164.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23812.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12215.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39600.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49879.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32016.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51518.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16695.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10186.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3642.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53417.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18185.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63603.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22856.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21548.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4056.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29780.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39143.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44746.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33277.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59779.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34663.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21548.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65493.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43978.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55499.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9477.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30477.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9477.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10186.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35562.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42363.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12215.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21917.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11307.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2160	dbac323d43d9e83b48c7d29806c68a49f3a7e99889f0e446051a331b7e9f12f2N.exe
2784	Unicorn-46680.exe
2168	Unicorn-46769.exe
2708	Unicorn-32016.exe
2812	Unicorn-10125.exe
3008	Unicorn-41620.exe
1076	Unicorn-54261.exe
2592	Unicorn-53087.exe
644	Unicorn-37851.exe
2672	Unicorn-61680.exe
2172	Unicorn-43419.exe
1156	Unicorn-12204.exe
2876	Unicorn-51535.exe
2564	Unicorn-32070.exe
2484	Unicorn-26899.exe
1452	Unicorn-46230.exe
1992	Unicorn-39109.exe
2424	Unicorn-59447.exe
2352	Unicorn-26905.exe
2164	Unicorn-21350.exe
1212	Unicorn-56915.exe
1628	Unicorn-18026.exe
1084	Unicorn-55379.exe
1112	Unicorn-44746.exe
1868	Unicorn-49249.exe
1720	Unicorn-23344.exe
944	Unicorn-25421.exe
2024	Unicorn-51518.exe
1712	Unicorn-51783.exe
2400	Unicorn-63412.exe
2516	Unicorn-10460.exe
2980	Unicorn-27674.exe
2064	Unicorn-49756.exe
2072	Unicorn-21844.exe
1596	Unicorn-36575.exe
1800	Unicorn-35444.exe
2472	Unicorn-58958.exe
2796	Unicorn-42705.exe
2700	Unicorn-10094.exe
2688	Unicorn-6861.exe
2648	Unicorn-6026.exe
2628	Unicorn-3950.exe
3012	Unicorn-23816.exe
296	Unicorn-14603.exe
3020	Unicorn-22856.exe
3028	Unicorn-40069.exe
2204	Unicorn-32124.exe
2116	Unicorn-19260.exe
1188	Unicorn-10987.exe
1952	Unicorn-22332.exe
1368	Unicorn-16201.exe
3000	Unicorn-54838.exe
1940	Unicorn-27292.exe
1792	Unicorn-2430.exe
2956	Unicorn-51933.exe
2308	Unicorn-58751.exe
2448	Unicorn-7967.exe
1880	Unicorn-30364.exe
1808	Unicorn-41414.exe
1016	Unicorn-21548.exe
2208	Unicorn-35284.exe
1716	Unicorn-42374.exe
1528	Unicorn-21548.exe
1532	Unicorn-41414.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 2784	2160	dbac323d43d9e83b48c7d29806c68a49f3a7e99889f0e446051a331b7e9f12f2N.exe	30
PID 2160 wrote to memory of 2784	2160	dbac323d43d9e83b48c7d29806c68a49f3a7e99889f0e446051a331b7e9f12f2N.exe	30
PID 2160 wrote to memory of 2784	2160	dbac323d43d9e83b48c7d29806c68a49f3a7e99889f0e446051a331b7e9f12f2N.exe	30
PID 2160 wrote to memory of 2784	2160	dbac323d43d9e83b48c7d29806c68a49f3a7e99889f0e446051a331b7e9f12f2N.exe	30
PID 2160 wrote to memory of 2168	2160	dbac323d43d9e83b48c7d29806c68a49f3a7e99889f0e446051a331b7e9f12f2N.exe	32
PID 2160 wrote to memory of 2168	2160	dbac323d43d9e83b48c7d29806c68a49f3a7e99889f0e446051a331b7e9f12f2N.exe	32
PID 2160 wrote to memory of 2168	2160	dbac323d43d9e83b48c7d29806c68a49f3a7e99889f0e446051a331b7e9f12f2N.exe	32
PID 2160 wrote to memory of 2168	2160	dbac323d43d9e83b48c7d29806c68a49f3a7e99889f0e446051a331b7e9f12f2N.exe	32
PID 2784 wrote to memory of 2708	2784	Unicorn-46680.exe	31
PID 2784 wrote to memory of 2708	2784	Unicorn-46680.exe	31
PID 2784 wrote to memory of 2708	2784	Unicorn-46680.exe	31
PID 2784 wrote to memory of 2708	2784	Unicorn-46680.exe	31
PID 2168 wrote to memory of 2812	2168	Unicorn-46769.exe	33
PID 2168 wrote to memory of 2812	2168	Unicorn-46769.exe	33
PID 2168 wrote to memory of 2812	2168	Unicorn-46769.exe	33
PID 2168 wrote to memory of 2812	2168	Unicorn-46769.exe	33
PID 2160 wrote to memory of 2592	2160	dbac323d43d9e83b48c7d29806c68a49f3a7e99889f0e446051a331b7e9f12f2N.exe	34
PID 2160 wrote to memory of 2592	2160	dbac323d43d9e83b48c7d29806c68a49f3a7e99889f0e446051a331b7e9f12f2N.exe	34
PID 2160 wrote to memory of 2592	2160	dbac323d43d9e83b48c7d29806c68a49f3a7e99889f0e446051a331b7e9f12f2N.exe	34
PID 2160 wrote to memory of 2592	2160	dbac323d43d9e83b48c7d29806c68a49f3a7e99889f0e446051a331b7e9f12f2N.exe	34
PID 2708 wrote to memory of 3008	2708	Unicorn-32016.exe	35
PID 2708 wrote to memory of 3008	2708	Unicorn-32016.exe	35
PID 2708 wrote to memory of 3008	2708	Unicorn-32016.exe	35
PID 2708 wrote to memory of 3008	2708	Unicorn-32016.exe	35
PID 2784 wrote to memory of 1076	2784	Unicorn-46680.exe	36
PID 2784 wrote to memory of 1076	2784	Unicorn-46680.exe	36
PID 2784 wrote to memory of 1076	2784	Unicorn-46680.exe	36
PID 2784 wrote to memory of 1076	2784	Unicorn-46680.exe	36
PID 2812 wrote to memory of 644	2812	Unicorn-10125.exe	37
PID 2812 wrote to memory of 644	2812	Unicorn-10125.exe	37
PID 2812 wrote to memory of 644	2812	Unicorn-10125.exe	37
PID 2812 wrote to memory of 644	2812	Unicorn-10125.exe	37
PID 2168 wrote to memory of 2672	2168	Unicorn-46769.exe	38
PID 2168 wrote to memory of 2672	2168	Unicorn-46769.exe	38
PID 2168 wrote to memory of 2672	2168	Unicorn-46769.exe	38
PID 2168 wrote to memory of 2672	2168	Unicorn-46769.exe	38
PID 3008 wrote to memory of 2172	3008	Unicorn-41620.exe	39
PID 3008 wrote to memory of 2172	3008	Unicorn-41620.exe	39
PID 3008 wrote to memory of 2172	3008	Unicorn-41620.exe	39
PID 3008 wrote to memory of 2172	3008	Unicorn-41620.exe	39
PID 2708 wrote to memory of 1156	2708	Unicorn-32016.exe	40
PID 2708 wrote to memory of 1156	2708	Unicorn-32016.exe	40
PID 2708 wrote to memory of 1156	2708	Unicorn-32016.exe	40
PID 2708 wrote to memory of 1156	2708	Unicorn-32016.exe	40
PID 2592 wrote to memory of 2564	2592	Unicorn-53087.exe	41
PID 2592 wrote to memory of 2564	2592	Unicorn-53087.exe	41
PID 2592 wrote to memory of 2564	2592	Unicorn-53087.exe	41
PID 2592 wrote to memory of 2564	2592	Unicorn-53087.exe	41
PID 2784 wrote to memory of 2484	2784	Unicorn-46680.exe	42
PID 2784 wrote to memory of 2484	2784	Unicorn-46680.exe	42
PID 2784 wrote to memory of 2484	2784	Unicorn-46680.exe	42
PID 2784 wrote to memory of 2484	2784	Unicorn-46680.exe	42
PID 2160 wrote to memory of 2876	2160	dbac323d43d9e83b48c7d29806c68a49f3a7e99889f0e446051a331b7e9f12f2N.exe	43
PID 2160 wrote to memory of 2876	2160	dbac323d43d9e83b48c7d29806c68a49f3a7e99889f0e446051a331b7e9f12f2N.exe	43
PID 2160 wrote to memory of 2876	2160	dbac323d43d9e83b48c7d29806c68a49f3a7e99889f0e446051a331b7e9f12f2N.exe	43
PID 2160 wrote to memory of 2876	2160	dbac323d43d9e83b48c7d29806c68a49f3a7e99889f0e446051a331b7e9f12f2N.exe	43
PID 644 wrote to memory of 1452	644	Unicorn-37851.exe	44
PID 644 wrote to memory of 1452	644	Unicorn-37851.exe	44
PID 644 wrote to memory of 1452	644	Unicorn-37851.exe	44
PID 644 wrote to memory of 1452	644	Unicorn-37851.exe	44
PID 2812 wrote to memory of 1992	2812	Unicorn-10125.exe	45
PID 2812 wrote to memory of 1992	2812	Unicorn-10125.exe	45
PID 2812 wrote to memory of 1992	2812	Unicorn-10125.exe	45
PID 2812 wrote to memory of 1992	2812	Unicorn-10125.exe	45

C:\Users\Admin\AppData\Local\Temp\dbac323d43d9e83b48c7d29806c68a49f3a7e99889f0e446051a331b7e9f12f2N.exe
"C:\Users\Admin\AppData\Local\Temp\dbac323d43d9e83b48c7d29806c68a49f3a7e99889f0e446051a331b7e9f12f2N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46680.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46680.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32016.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32016.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41620.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41620.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43419.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55379.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22332.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16695.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42363.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:2976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16322.exe
        9⤵
        
        PID:3100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24187.exe
        9⤵
        
        PID:4136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2421.exe
        9⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10923.exe
        8⤵
        
        PID:904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30057.exe
        8⤵
        
        PID:3940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30477.exe
        8⤵
        
        PID:4152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40041.exe
        8⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13585.exe
        8⤵
        
        PID:6768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55646.exe
        7⤵
        
        PID:2580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41351.exe
        8⤵
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16322.exe
        8⤵
        
        PID:3980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39600.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19442.exe
        8⤵
        
        PID:5356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16298.exe
        8⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6798.exe
        7⤵
        
        PID:2868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35923.exe
        7⤵
        
        PID:3584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36799.exe
        7⤵
        
        PID:4988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59779.exe
        7⤵
        
        PID:5460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16828.exe
        7⤵
        
        PID:5708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27292.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39181.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1066.exe
        8⤵
        
        PID:6648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19688.exe
        7⤵
        
        PID:1660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30057.exe
        7⤵
        
        PID:3944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27868.exe
        7⤵
        
        PID:4952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46164.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49356.exe
        6⤵
        
        PID:308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52441.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17196.exe
        7⤵
        
        PID:4612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58061.exe
        7⤵
        
        PID:6548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17135.exe
        6⤵
        
        PID:2660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43978.exe
        6⤵
        
        PID:3864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31008.exe
        6⤵
        
        PID:4512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23060.exe
        6⤵
        
        PID:6608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23344.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19260.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65493.exe
        7⤵
        
        PID:1928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60314.exe
        7⤵
        
        PID:3884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57275.exe
        8⤵
        
        PID:3848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19542.exe
        8⤵
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58061.exe
        8⤵
        
        PID:6568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6350.exe
        7⤵
        
        PID:4256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39143.exe
        7⤵
        
        PID:5028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41552.exe
        7⤵
        
        PID:6336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27415.exe
        6⤵
        
        PID:2304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35923.exe
        6⤵
        
        PID:3076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13942.exe
        6⤵
        
        PID:4500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57107.exe
        6⤵
        
        PID:5880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37254.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37815.exe
        5⤵
        
        PID:1688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30977.exe
        6⤵
        
        PID:856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18185.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29780.exe
        6⤵
        
        PID:3200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54678.exe
        6⤵
        
        PID:4036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39143.exe
        6⤵
        
        PID:4528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56577.exe
        6⤵
        
        PID:4936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53417.exe
        6⤵
        
        PID:6188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42122.exe
        5⤵
        
        PID:872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65493.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29011.exe
        6⤵
        
        PID:3900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6350.exe
        6⤵
        
        PID:4272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39143.exe
        6⤵
        
        PID:5068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56577.exe
        6⤵
        
        PID:5616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1009.exe
        6⤵
        
        PID:6296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40027.exe
        5⤵
        
        PID:2864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22495.exe
        5⤵
        
        PID:3792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48086.exe
        5⤵
        
        PID:4384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4142.exe
        5⤵
        
        PID:5092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34441.exe
        5⤵
        
        PID:5800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38918.exe
        5⤵
        
        PID:6464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12204.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12204.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44746.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58751.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44908.exe
        7⤵
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26301.exe
        7⤵
        
        PID:3620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12215.exe
        7⤵
        
        PID:4208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30477.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40041.exe
        7⤵
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13585.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55858.exe
        6⤵
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14881.exe
        7⤵
        
        PID:7148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26301.exe
        6⤵
        
        PID:3660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12215.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30477.exe
        6⤵
        
        PID:3484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40041.exe
        6⤵
        
        PID:5448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30364.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40581.exe
        6⤵
        
        PID:1788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12566.exe
        6⤵
        
        PID:3740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6350.exe
        6⤵
        
        PID:4304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39143.exe
        6⤵
        
        PID:4160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56577.exe
        6⤵
        
        PID:5608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53417.exe
        6⤵
        
        PID:6184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33281.exe
        5⤵
        
        PID:2760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27257.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4852.exe
        5⤵
        
        PID:4224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38410.exe
        5⤵
        
        PID:896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49249.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49249.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22856.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27452.exe
        6⤵
        
        PID:2068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12566.exe
        6⤵
        
        PID:3732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6350.exe
        6⤵
        
        PID:4280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39143.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41552.exe
        6⤵
        
        PID:6344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55243.exe
        5⤵
        
        PID:1200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48612.exe
        5⤵
        
        PID:3924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17322.exe
        5⤵
        
        PID:4676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10662.exe
        5⤵
        
        PID:5420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23812.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32124.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32124.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30977.exe
        5⤵
        
        PID:2244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30389.exe
        6⤵
        
        PID:3480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19542.exe
        6⤵
        
        PID:4788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59377.exe
        6⤵
        
        PID:5992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3931.exe
        6⤵
        
        PID:6840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29780.exe
        5⤵
        
        PID:3192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3642.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30477.exe
        5⤵
        
        PID:4484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40041.exe
        5⤵
        
        PID:6080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13585.exe
        5⤵
        
        PID:6760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42122.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42122.exe
      4⤵
      PID:2444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49646.exe
        5⤵
        
        PID:3420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37845.exe
        5⤵
        
        PID:4120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39143.exe
        5⤵
        
        PID:4548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56577.exe
        5⤵
        
        PID:5544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24180.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24180.exe
      4⤵
      PID:3232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52408.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52408.exe
      4⤵
      PID:3428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9477.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9477.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30241.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30241.exe
      4⤵
      PID:5812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36119.exe
      4⤵
      PID:6508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54261.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54261.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59447.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59447.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21844.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42374.exe
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49646.exe
        7⤵
        
        PID:3364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37845.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39143.exe
        7⤵
        
        PID:2332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56577.exe
        7⤵
        
        PID:2492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53417.exe
        7⤵
        
        PID:6224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18465.exe
        6⤵
        
        PID:2220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30057.exe
        6⤵
        
        PID:3960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30477.exe
        6⤵
        
        PID:2088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40041.exe
        6⤵
        
        PID:5364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18214.exe
        5⤵
        
        PID:1600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31301.exe
        6⤵
        
        PID:3552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22922.exe
        6⤵
        
        PID:4668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10597.exe
        6⤵
        
        PID:5564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10678.exe
        6⤵
        
        PID:6980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25444.exe
        5⤵
        
        PID:2856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35923.exe
        5⤵
        
        PID:4060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56006.exe
        5⤵
        
        PID:5108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42757.exe
        5⤵
        
        PID:6032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36575.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36575.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41414.exe
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49646.exe
        6⤵
        
        PID:3336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12328.exe
        6⤵
        
        PID:3540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33277.exe
        6⤵
        
        PID:5080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65242.exe
        6⤵
        
        PID:5928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23252.exe
        6⤵
        
        PID:6416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2980.exe
        5⤵
        
        PID:376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30057.exe
        5⤵
        
        PID:3084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30053.exe
        5⤵
        
        PID:4336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41552.exe
        5⤵
        
        PID:6328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-124.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-124.exe
      4⤵
      PID:972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21748.exe
        5⤵
        
        PID:1708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30057.exe
        5⤵
        
        PID:3916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49549.exe
        5⤵
        
        PID:4920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27798.exe
        5⤵
        
        PID:5964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24615.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24615.exe
      4⤵
      PID:2112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10722.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10722.exe
      4⤵
      PID:4084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21917.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21917.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38292.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38292.exe
      4⤵
      PID:6048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55499.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55499.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26899.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26899.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25421.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25421.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40069.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40931.exe
        6⤵
        
        PID:880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62477.exe
        6⤵
        
        PID:4004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6574.exe
        7⤵
        
        PID:3684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19542.exe
        7⤵
        
        PID:4772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58061.exe
        7⤵
        
        PID:6576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45263.exe
        6⤵
        
        PID:4580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10132.exe
        6⤵
        
        PID:5380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45874.exe
        6⤵
        
        PID:5740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43164.exe
        5⤵
        
        PID:288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42788.exe
        6⤵
        
        PID:4700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64734.exe
        6⤵
        
        PID:5388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47613.exe
        6⤵
        
        PID:5912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26301.exe
        5⤵
        
        PID:3652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12215.exe
        5⤵
        
        PID:4368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30477.exe
        5⤵
        
        PID:4624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40041.exe
        5⤵
        
        PID:5336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61333.exe
        5⤵
        
        PID:6944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10987.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10987.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36668.exe
        5⤵
        
        PID:2676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28587.exe
        6⤵
        
        PID:6488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12566.exe
        5⤵
        
        PID:3700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6350.exe
        5⤵
        
        PID:4296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39143.exe
        5⤵
        
        PID:4968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56577.exe
        5⤵
        
        PID:5652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1009.exe
        5⤵
        
        PID:6360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54788.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54788.exe
      4⤵
      PID:2480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32167.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32167.exe
      4⤵
      PID:3644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3550.exe
      4⤵
      PID:4396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13942.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13942.exe
      4⤵
      PID:4892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57107.exe
      4⤵
      PID:5864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37254.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37254.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51518.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51518.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54838.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13680.exe
        5⤵
        
        PID:1320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30057.exe
        5⤵
        
        PID:3952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64671.exe
        5⤵
        
        PID:5116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46164.exe
        5⤵
        
        PID:6088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45628.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45628.exe
      4⤵
      PID:1976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8512.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8512.exe
      4⤵
      PID:3876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12215.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12215.exe
      4⤵
      PID:4352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30477.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30477.exe
      4⤵
      PID:4752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40041.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40041.exe
      4⤵
      PID:5348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51933.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51933.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10186.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10186.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12566.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12566.exe
      4⤵
      PID:3724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6350.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6350.exe
      4⤵
      PID:4288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39143.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39143.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56577.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56577.exe
      4⤵
      PID:5644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53417.exe
      4⤵
      PID:6248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50258.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50258.exe
    3⤵
    PID:2272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23522.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23522.exe
      4⤵
      PID:6380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24031.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24031.exe
    3⤵
    PID:3676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48086.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48086.exe
    3⤵
    PID:4236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4142.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4142.exe
    3⤵
    PID:4896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34441.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34441.exe
    3⤵
    PID:5824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8383.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8383.exe
    3⤵
    PID:6624
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46769.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46769.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10125.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10125.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37851.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37851.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46230.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10460.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41414.exe
        7⤵
        Executes dropped EXE
        
        PID:1384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49646.exe
        8⤵
        
        PID:3380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30403.exe
        8⤵
        
        PID:3608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33277.exe
        8⤵
        
        PID:5088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65242.exe
        8⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20961.exe
        7⤵
        
        PID:1376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30057.exe
        7⤵
        
        PID:3964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45465.exe
        7⤵
        
        PID:4960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46164.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21548.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7550.exe
        7⤵
        
        PID:2280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12566.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6350.exe
        7⤵
        
        PID:4264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39143.exe
        7⤵
        
        PID:4940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56577.exe
        7⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53417.exe
        7⤵
        
        PID:6232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26365.exe
        6⤵
        
        PID:1588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52804.exe
        7⤵
        
        PID:1444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16322.exe
        7⤵
        
        PID:3972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58806.exe
        7⤵
        
        PID:5060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54658.exe
        7⤵
        
        PID:5576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38329.exe
        6⤵
        
        PID:2776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27257.exe
        6⤵
        
        PID:4040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61048.exe
        6⤵
        
        PID:5012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11307.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60834.exe
        6⤵
        
        PID:7140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35444.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30977.exe
        6⤵
        
        PID:1624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49646.exe
        7⤵
        
        PID:3372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37845.exe
        7⤵
        
        PID:4112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39143.exe
        7⤵
        
        PID:5052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56577.exe
        7⤵
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1009.exe
        7⤵
        
        PID:6312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29780.exe
        6⤵
        
        PID:3256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40973.exe
        6⤵
        
        PID:1920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39143.exe
        6⤵
        
        PID:5032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56577.exe
        6⤵
        
        PID:5748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1009.exe
        6⤵
        
        PID:6356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44922.exe
        5⤵
        
        PID:356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6314.exe
        6⤵
        
        PID:3448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64638.exe
        6⤵
        
        PID:2044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33277.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65242.exe
        6⤵
        
        PID:5936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58255.exe
        6⤵
        
        PID:6544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49381.exe
        5⤵
        
        PID:3216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43978.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31008.exe
        5⤵
        
        PID:4444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23060.exe
        5⤵
        
        PID:6616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39109.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39109.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27674.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41414.exe
        6⤵
        
        PID:1392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50222.exe
        7⤵
        
        PID:3388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58540.exe
        7⤵
        
        PID:3352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45494.exe
        7⤵
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18128.exe
        7⤵
        
        PID:7064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40618.exe
        6⤵
        
        PID:1680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30057.exe
        6⤵
        
        PID:3096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30053.exe
        6⤵
        
        PID:4348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56577.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53417.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21548.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23087.exe
        6⤵
        
        PID:2684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22967.exe
        7⤵
        
        PID:7136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29780.exe
        6⤵
        
        PID:3184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26063.exe
        6⤵
        
        PID:3500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39143.exe
        6⤵
        
        PID:4540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56577.exe
        6⤵
        
        PID:5624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53417.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53495.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49381.exe
        5⤵
        
        PID:3224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51878.exe
        5⤵
        
        PID:3156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13942.exe
        5⤵
        
        PID:924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57107.exe
        5⤵
        
        PID:5848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37254.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49756.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49756.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41414.exe
        5⤵
        Executes dropped EXE
        
        PID:1612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37104.exe
        5⤵
        
        PID:1832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10186.exe
        6⤵
        
        PID:2268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12566.exe
        6⤵
        
        PID:3692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6350.exe
        6⤵
        
        PID:4312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39143.exe
        6⤵
        
        PID:4464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56577.exe
        6⤵
        
        PID:5516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53417.exe
        6⤵
        
        PID:6208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30537.exe
        5⤵
        
        PID:1572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32167.exe
        5⤵
        
        PID:3628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17322.exe
        5⤵
        
        PID:4652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26029.exe
        5⤵
        
        PID:5584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49879.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41149.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41149.exe
      4⤵
      PID:780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36534.exe
        5⤵
        
        PID:1820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41762.exe
        5⤵
        
        PID:3856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33277.exe
        5⤵
        
        PID:5072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65242.exe
        5⤵
        
        PID:5944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58255.exe
        5⤵
        
        PID:6540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52514.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52514.exe
      4⤵
      PID:2756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10722.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10722.exe
      4⤵
      PID:4024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37330.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37330.exe
      4⤵
      PID:4996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25163.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25163.exe
      4⤵
      PID:6112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55499.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55499.exe
      4⤵
      PID:5696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61680.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61680.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26905.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26905.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42705.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41414.exe
        6⤵
        
        PID:940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13680.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30057.exe
        7⤵
        
        PID:1232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30477.exe
        7⤵
        
        PID:4620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40041.exe
        7⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61333.exe
        7⤵
        
        PID:6968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6453.exe
        6⤵
        
        PID:2416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4345.exe
        7⤵
        
        PID:5504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37525.exe
        7⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65108.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56452.exe
        6⤵
        
        PID:3892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12215.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30477.exe
        6⤵
        
        PID:4664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40041.exe
        6⤵
        
        PID:932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21548.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49646.exe
        6⤵
        
        PID:3396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40942.exe
        6⤵
        
        PID:3460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33277.exe
        6⤵
        
        PID:4908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65242.exe
        6⤵
        
        PID:6012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60803.exe
        6⤵
        
        PID:6896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6798.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52698.exe
        5⤵
        
        PID:3768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13942.exe
        5⤵
        
        PID:4516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57107.exe
        5⤵
        
        PID:5856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10094.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10094.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4056.exe
        5⤵
        
        PID:1744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9551.exe
        6⤵
        
        PID:7112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32167.exe
        5⤵
        
        PID:3636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3550.exe
        5⤵
        
        PID:4244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13942.exe
        5⤵
        
        PID:4916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57107.exe
        5⤵
        
        PID:5900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39802.exe
        5⤵
        
        PID:6848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35284.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35284.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24623.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6832.exe
        6⤵
        
        PID:6272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29780.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54678.exe
        5⤵
        
        PID:3492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39143.exe
        5⤵
        
        PID:4720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56577.exe
        5⤵
        
        PID:5604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53417.exe
        5⤵
        
        PID:6240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9921.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9921.exe
      4⤵
      PID:1060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23501.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23501.exe
      4⤵
      PID:3668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52552.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52552.exe
      4⤵
      PID:4228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31008.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31008.exe
      4⤵
      PID:4932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23060.exe
      4⤵
      PID:6600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21350.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21350.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58958.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58958.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41414.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24259.exe
        6⤵
        
        PID:2040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45478.exe
        6⤵
        
        PID:3440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39398.exe
        6⤵
        
        PID:4600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47030.exe
        6⤵
        
        PID:5596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59680.exe
        6⤵
        
        PID:6972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13680.exe
        5⤵
        
        PID:1648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30057.exe
        5⤵
        
        PID:3872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30477.exe
        5⤵
        
        PID:4608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40041.exe
        5⤵
        
        PID:6140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22246.exe
        5⤵
        
        PID:6832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20972.exe
      4⤵
      PID:3040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57412.exe
        5⤵
        
        PID:2436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16322.exe
        5⤵
        
        PID:3104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39143.exe
        5⤵
        
        PID:4488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56577.exe
        5⤵
        
        PID:5668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1009.exe
        5⤵
        
        PID:6368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4302.exe
      4⤵
      PID:2996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35923.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35923.exe
      4⤵
      PID:2572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21387.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21387.exe
      4⤵
      PID:4344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59779.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59779.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6861.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6861.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59399.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59399.exe
      4⤵
      PID:2288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19708.exe
        5⤵
        
        PID:5432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5363.exe
        5⤵
        
        PID:5952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29780.exe
      4⤵
      PID:3264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3642.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3642.exe
      4⤵
      PID:3512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30477.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30477.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40041.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40041.exe
      4⤵
      PID:5344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61333.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61333.exe
      4⤵
      PID:7012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22046.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22046.exe
    3⤵
    PID:1692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49646.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49646.exe
      4⤵
      PID:3344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49848.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49848.exe
      4⤵
      PID:3496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18797.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18797.exe
      4⤵
      PID:5412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44813.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44813.exe
      4⤵
      PID:5540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24180.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24180.exe
    3⤵
    PID:3240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6196.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6196.exe
    3⤵
    PID:3408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9477.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9477.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30241.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30241.exe
    3⤵
    PID:5808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1117.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1117.exe
    3⤵
    PID:6392
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53087.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53087.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32070.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32070.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51783.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51783.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2430.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7478.exe
        6⤵
        
        PID:536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42788.exe
        7⤵
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64734.exe
        7⤵
        
        PID:5396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42621.exe
        7⤵
        
        PID:6688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41841.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30057.exe
        6⤵
        
        PID:4072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64671.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10777.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65300.exe
        6⤵
        
        PID:5924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35620.exe
        5⤵
        
        PID:1768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62980.exe
        6⤵
        
        PID:2340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16322.exe
        6⤵
        
        PID:3992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35540.exe
        6⤵
        
        PID:1028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65242.exe
        6⤵
        
        PID:5888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58255.exe
        6⤵
        
        PID:6528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7637.exe
        5⤵
        
        PID:2344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35923.exe
        5⤵
        
        PID:4052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13942.exe
        5⤵
        
        PID:4496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57107.exe
        5⤵
        
        PID:5840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7967.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7967.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14513.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22562.exe
        6⤵
        
        PID:7100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29780.exe
        5⤵
        
        PID:3272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6738.exe
        5⤵
        
        PID:3528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39143.exe
        5⤵
        
        PID:5020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56577.exe
        5⤵
        
        PID:5760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1009.exe
        5⤵
        
        PID:6320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38778.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38778.exe
      4⤵
      PID:2788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48463.exe
        5⤵
        
        PID:4708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52196.exe
        5⤵
        
        PID:6556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49381.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49381.exe
      4⤵
      PID:3208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23263.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23263.exe
      4⤵
      PID:3504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13942.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13942.exe
      4⤵
      PID:4756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57107.exe
      4⤵
      PID:5872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63412.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63412.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2400
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 240
      4⤵
      Program crash
      PID:1160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16201.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16201.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49866.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49866.exe
      4⤵
      PID:2404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15206.exe
        5⤵
        
        PID:4764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43435.exe
        5⤵
        
        PID:5548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58518.exe
        5⤵
        
        PID:6924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52771.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52771.exe
      4⤵
      PID:300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62564.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62564.exe
      4⤵
      PID:3164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30477.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30477.exe
      4⤵
      PID:4564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40041.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40041.exe
      4⤵
      PID:6132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61333.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61333.exe
      4⤵
      PID:7004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11962.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11962.exe
    3⤵
    PID:2140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3907.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3907.exe
      4⤵
      PID:4100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7179.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7179.exe
      4⤵
      PID:5688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34663.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34663.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8470.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8470.exe
    3⤵
    PID:1488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36162.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36162.exe
    3⤵
    PID:3536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31008.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31008.exe
    3⤵
    PID:4392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35576.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35576.exe
    3⤵
    PID:5976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34467.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34467.exe
    3⤵
    PID:6904
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51535.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51535.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56915.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56915.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6026.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6026.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10186.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12566.exe
        5⤵
        
        PID:3708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6350.exe
        5⤵
        
        PID:4320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39143.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56577.exe
        5⤵
        
        PID:5484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11859.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11859.exe
      4⤵
      PID:1360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30631.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30631.exe
      4⤵
      PID:3784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3550.exe
      4⤵
      PID:4404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13942.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13942.exe
      4⤵
      PID:4436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57107.exe
      4⤵
      PID:5828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2252.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2252.exe
      4⤵
      PID:6408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3950.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3950.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44908.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44908.exe
      4⤵
      PID:2752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47825.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29780.exe
      4⤵
      PID:3280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26063.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26063.exe
      4⤵
      PID:3568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39143.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39143.exe
      4⤵
      PID:4184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56577.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56577.exe
      4⤵
      PID:6008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53417.exe
      4⤵
      PID:6264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4056.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4056.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33546.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33546.exe
      4⤵
      PID:2952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16322.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16322.exe
      4⤵
      PID:4088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61850.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61850.exe
      4⤵
      PID:4640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65242.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65242.exe
      4⤵
      PID:5956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7619.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7619.exe
    3⤵
    PID:2276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36162.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36162.exe
    3⤵
    PID:3804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31008.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31008.exe
    3⤵
    PID:4428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49147.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49147.exe
    3⤵
    PID:6784
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18026.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18026.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23816.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23816.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55486.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55486.exe
      4⤵
      PID:1860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42937.exe
        5⤵
        
        PID:4812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45642.exe
        5⤵
        
        PID:5984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63603.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63072.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63072.exe
      4⤵
      PID:2556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55498.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55498.exe
      4⤵
      PID:3748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39143.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39143.exe
      4⤵
      PID:4472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56577.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56577.exe
      4⤵
      PID:5524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53417.exe
      4⤵
      PID:6196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8039.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8039.exe
    3⤵
    PID:848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55426.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55426.exe
      4⤵
      PID:4076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25662.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25662.exe
      4⤵
      PID:4572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12932.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12932.exe
      4⤵
      PID:5404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53478.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53478.exe
      4⤵
      PID:5352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43516.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43516.exe
    3⤵
    PID:3288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31929.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31929.exe
    3⤵
    PID:3520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30477.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30477.exe
    3⤵
    PID:4412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40041.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40041.exe
    3⤵
    PID:920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13585.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13585.exe
    3⤵
    PID:6776
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14603.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14603.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35968.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35968.exe
    3⤵
    PID:2804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26683.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26683.exe
      4⤵
      PID:2364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49646.exe
        5⤵
        
        PID:3356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37845.exe
        5⤵
        
        PID:3780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39143.exe
        5⤵
        
        PID:4728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56577.exe
        5⤵
        
        PID:5560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1009.exe
        5⤵
        
        PID:6284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29780.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26063.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26063.exe
      4⤵
      PID:3516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39143.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39143.exe
      4⤵
      PID:4196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56577.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56577.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1009.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1009.exe
      4⤵
      PID:6372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21010.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21010.exe
    3⤵
    PID:868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12480.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12480.exe
      4⤵
      PID:4216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7179.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7179.exe
      4⤵
      PID:5676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43516.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43516.exe
    3⤵
    PID:3296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14331.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14331.exe
    3⤵
    PID:3412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30477.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30477.exe
    3⤵
    PID:4868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40041.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40041.exe
    3⤵
    PID:6124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61333.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61333.exe
    3⤵
    PID:6956
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1138.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1138.exe
  2⤵
  PID:2872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37561.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37561.exe
    3⤵
    PID:2704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51533.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51533.exe
      4⤵
      PID:6300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12566.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12566.exe
    3⤵
    PID:3612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6350.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6350.exe
    3⤵
    PID:4188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39143.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39143.exe
    3⤵
    PID:4860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56577.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56577.exe
    3⤵
    PID:5636
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35562.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35562.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2408
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61167.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61167.exe
  2⤵
  PID:3808
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46951.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46951.exe
  2⤵
  PID:4200
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46143.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46143.exe
  2⤵
  PID:4736
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54042.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54042.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5752
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36118.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36118.exe
  2⤵
  PID:6452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11859.exe

Filesize
468KB

MD5
1de75b08dc7e664b7b91170788682292

SHA1
dfed2db50b700b4b04e61f7201206891773f9f58

SHA256
ad6c4304c33726404292b7e9cc76caaaf220cb38f4d7b1af63fd73d164680f48

SHA512
29ed986d34f1500bf966a13a0f2c6fcffe7503c32914c22c1670012c0562ec05ee57064240fe879229f41fda75274f6b741dc5462358ccf316356e53dbcbcb17

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32070.exe

Filesize
468KB

MD5
271c36b504ed9cb240b91f9e5e0e565e

SHA1
3dd355b4991a678f6c470d3b0562242cb1f73656

SHA256
17f91c6b4ad03f60d2c1fa3ffd73cd215ec6dd37ca6715440effff5ea9e8aaa1

SHA512
c478a35f882aae615cfdf0745156fdc10c3adf6db93c4398ee0a0ca1029bbf16a659589ff51e52b63b3dce3279a3cd1767083b86ac70eef1116f4542d93fa111

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37851.exe

Filesize
468KB

MD5
ed151cf9656f244a777ef4ea42737c6d

SHA1
1464d8a1ed896d91dde98b4dfdc2f282de7d1292

SHA256
e10645d25625b1f795968236a53e1fce1c9f60b337c5b050e1d67262f3898f4c

SHA512
65ff31ee74cda9cd99ade44dcfa931c241bb771c6cd93543d0230272e0572de8fdff3fd027532673ed65f0596f7c352d5765cd78520b83b9756bf97d34794688

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45642.exe

Filesize
468KB

MD5
c723066553ccddf1ba56be59199d32e8

SHA1
1e78569f9cb1b3c1f0c9dd9ad4e47949a2a60d7a

SHA256
f67e14ec08962427b42b017760f514a34ddf00886672a6161c68c8d9609687cc

SHA512
2a1c61ae3409b42b10d3738c2df154200a2ab1915bd8b1fb1c1b4fc19cb0110c315923eae881326d65d80e213dbef7ba3dabf639f5bdd3a7f767b0edea241285

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46769.exe

Filesize
468KB

MD5
6449bb703670b2b0d643e1b0eb216425

SHA1
249c099f5453998d6fbac5f78b9df5736103bd48

SHA256
df13e3587bd3e930202dade48cf2471afd68ec8d9348cf8ef71df9aec5847c9b

SHA512
b38641911031cd96f9d59353db1eca28ccd8593edcb52ad6613ed794a9835defa34bcc3d828eb3d880809a9685b27fdabb3067db6ebb48b36fdac3034ed2992c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53087.exe

Filesize
468KB

MD5
db663318521683d421a1d580ad97d71f

SHA1
a42b19448d204fdd1d655f2b4ab1df73a3ca2394

SHA256
66ef91e63636a13fdae9ebe951d81754a74f7e4bc99908e4bab3a106c85370f0

SHA512
0d607ba644510f8409ad484e635019eb55c96065407ff9a900a3a7c1ece8965ba6230d2e69c2416b98a70c616ad4cea9b7267c9f4e066bac289662d45d737c7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54261.exe

Filesize
468KB

MD5
d585d056b4ed50bd22bf4d6f43e7b7ab

SHA1
5f9cf7ec70c867c6f935dacfe418e627614b0c3a

SHA256
3e030c4f9a4acafb61d449bdd0d14e8378eb5dbc36b8529d7c532a3ee47c8d03

SHA512
3e1020547650bb2ac03154fd430135e3a894625b0f7b717e53ae0332b20a5a935e69c2f4cf1b5382989ccfab2ad4fd995b5282f19be7c8fca637c66694bcdf09

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59447.exe

Filesize
468KB

MD5
45dd83ecfebebfe22a9263620e505d9d

SHA1
0fb3b6271bd46c7d93722a017e359d2c5e315ff6

SHA256
c3c5aa0b87017ce6ec9d7d2fdeec8d2c6c2e225f4c0dfc59c17741b788e920e1

SHA512
644fe331c94795f461b70825c955e039cef987958faff0d38ca4a02da5cb5d7172c286c7dd42bf7553ffcb4f4a99e23067a19adbaa687aa1f8b77a372c481434

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-10125.exe

Filesize
468KB

MD5
2dc619b171760605af47127b3d0bf0a2

SHA1
77870021ce1a4d0d19b8fe352698c5c96d49f08e

SHA256
0de8bd50073ca4bf5722740ae5f97efa863e049068a79882e14d49366a73d44b

SHA512
21f60c363fe14ba9c0d72547d52a0275536b1734a2b8ddf3dc42a794a66da66d9cd39cc4482e24139e74b2c8e908d3b4d14e06fdedfe48d4e9c1b05aed5b5789

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-12204.exe

Filesize
468KB

MD5
d73d52a3bc1f168c6ca499b5d57bf209

SHA1
ad6b5a1af232818e4df6ec00149bbcd04a3d5a26

SHA256
345edbe9ec690dc5b3dc2ebdd6c96a5d99fca875457a4596046f7a8ffeece4c6

SHA512
f78c6d9cc58d128671b122e67462d2bde9556c7abd4cc30ba3088f9a4b9f1bd6aaad66300a0310940d43d7d9ebb873f245cd09808a7c5908d8803ac152fb823a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-26899.exe

Filesize
468KB

MD5
ad1d4fb85b6403ca1d823110f710e9f5

SHA1
f76ab5d020550eda50c48dbbd205e2a5027d4a71

SHA256
ce9659b7c8d4bc3e83dbb87215861f93e31987fea837099e61a7974603ec76de

SHA512
a1e97e2907e558a079e3cc574b80f01ac1221e662df47f9eee46e4b3c584cfd75148d1ab47bf97d3946efc4f4177394bc99e00e7c27b535ce2b205493ade3833

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-26905.exe

Filesize
468KB

MD5
b2d4f04e98a318c9bd8b3ee4de61b541

SHA1
8ade59d297d8fe141fa483c487bdefe5a202769d

SHA256
5cfe79811354d1c46f8c5d4ad5dc7cd7493363207c77066453e93c9069af9437

SHA512
de28f69b5d849fbf109a0f1dc633b2aace998d4f784c0f4993072814f93a698d4f69ffa5c539333356f90bd069a5166ac4baf14abff629b7e6ed6b00f8e52492

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-32016.exe

Filesize
468KB

MD5
f47516ce4398ddc797c42f35a3057e72

SHA1
0cfcad6711eec5661be053fd1cd7022ac25a2464

SHA256
2ae6c3828e234199c56c53b4d16a2145116a03cd1924e521c9bf093c864f4541

SHA512
2fd68165defe4a7c49a3f658612f844514d6c5a6f002a34bf96482f0ecb1e6559271d053701c8ba0b5b2a617f1a0e7a3f664587882033d6a55a351c44347a56f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-39109.exe

Filesize
468KB

MD5
dd4e8b324a44fbfb452e5c733fc7ba2f

SHA1
0879b933651d0de7e6d38b8f4a54bcc6718ed2bd

SHA256
455729b8b9eb11f239d2f916169c4bae755ea5d14e47aeddf1252f91ab58c3a5

SHA512
95a82629b6d20380a5aea5ec6e377e1d56fd8c52073eef5d4413d7933a759de0e771465fa619a0f3adac8eb06314d2275eb9c3ba62e2cdc650139bb8d41452b3

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-41620.exe

Filesize
468KB

MD5
ad9e9878ef093c9556d6f3bc3691859e

SHA1
7940b186c51114dfdab9c2a59ffd2cf924ef3bb8

SHA256
1ac67da01e4d36bede1d6c9076d9781bc3727aadba60ea2cf05573c1113c1c94

SHA512
e677e1f923510b6e196b3c86382341c5dab0d08a67e33a857d89cbb1252fc43064a0c535711822f3d89fffbc4a134a13549b35108adb1c49aaa6ca416e4949a8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-43419.exe

Filesize
468KB

MD5
15712d665a8fd5d6afc495086a199b53

SHA1
7737a54ac1c8e7dd9378b15f74d1424815cff0db

SHA256
2356c48a7786553bce5c3412ee9224c1211f0c02482422af51ef1d16a5671042

SHA512
451e3bbd25194409635d953958ffc5b16d5260508208ab02a51aba66ffc14aae81195d5105b9b1fc19218dbf94495461fff0ba01825c014dffc75cda7b30f807

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-46230.exe

Filesize
468KB

MD5
5d45456b91889bc33c176a40a2c0a9c0

SHA1
b2d2d187bee08227829b3b721a9637e967cdf88e

SHA256
1c9efae8433745bcb12e74d38c61c7668d72b064df8cc6d512a12a389204ac10

SHA512
d996b199dbd161ca7b942baef2f947c09e3965705f1e2ce76328c81e2bb0631b69f7244c4a914669072f69fde00bb2a9c1d14af9be289840ae9cc82db7992258

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-46680.exe

Filesize
468KB

MD5
c8eb008ccc3c9223a1974062f5966798

SHA1
26a7525d3c580448b83d334de3c954c592c3c4d6

SHA256
d157f3257b1d84f5826eb03c59c0b108af7f8d21d8f2029df11a1852aea4b22b

SHA512
e53dd0bdd6a58639c3af42619e4a7fe548f54fd669343cc7e0cac828a91f3d24c8eb952496dc9a57bab7c47e6274b0c09e04463b2c2a0035a2576249f4bf2bcb

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-51535.exe

Filesize
468KB

MD5
e1b7fd1bb00e7fbd220a9818314fc150

SHA1
003c66b99316979e5ac2a0eca28ef50828db8385

SHA256
a913c269969fdd6708be60d9e725ca00e4d5be64b0d83e7cd6c552e6b030fb7d

SHA512
f840de615e18d590a390e49147d829d82b42750c630a64aba79c7d8d5fe2e1a35f05666335c41c7027e814b1ab5eb7e6f863823916adbdd17f52e694cc7796c6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-61680.exe

Filesize
468KB

MD5
c903a8f374293aed2469132815f09bed

SHA1
1737cde1dda9dc2a9a5d18cab44a91644467a3d2

SHA256
8130d26f760f268549cca3acabbc4f4cd4927e36d8cb174fa9815634065facf1

SHA512
ed60b6619c09667bdb3e74005f16b71dbacd0fd9b6969373136ffe7f8cf6ce6068338fc59548e3a19cef2f12e265ce0d7c242a3100b62b491b2d3a05a4693d76

Download Submit