46f627575391f18082046dfa4e7b0e80aed62b12ad1097dd1bcdea7f50c0cf9a

Analysis

max time kernel
117s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10-10-2024 11:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

46f627575391f18082046dfa4e7b0e80aed62b12ad1097dd1bcdea7f50c0cf9aN.exe
Size

468KB
MD5

1569914448ff7ac969246363624b24c0
SHA1

29befc989aa496ab31b72928dad6724dab749f8d
SHA256

46f627575391f18082046dfa4e7b0e80aed62b12ad1097dd1bcdea7f50c0cf9a
SHA512

26e67772ea632a1be28f0f3a5e3566f82158cd075a2410b54a77a830182ac332e0ad4dbd836dc2c122dccb36613ccddd31c6deee661b9c8ccef4bc46fef5d2a2
SSDEEP

3072:0F9aogBRj2832bYoKz3yqf8/oCbryIplPmHxvTH5Zp++gmHNBTlV:0FUoiX32bKDyqf10clZpZ3HNB

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2772	Unicorn-51405.exe
2852	Unicorn-46226.exe
2848	Unicorn-30444.exe
2568	Unicorn-37347.exe
1352	Unicorn-9443.exe
236	Unicorn-55529.exe
1112	Unicorn-55115.exe
2124	Unicorn-29117.exe
2800	Unicorn-13335.exe
2544	Unicorn-38629.exe
1100	Unicorn-1872.exe
264	Unicorn-47544.exe
1584	Unicorn-58784.exe
536	Unicorn-52919.exe
2168	Unicorn-59049.exe
1860	Unicorn-65354.exe
2500	Unicorn-9884.exe
2528	Unicorn-33834.exe
968	Unicorn-7283.exe
1380	Unicorn-62422.exe
1724	Unicorn-21560.exe
2088	Unicorn-16922.exe
2452	Unicorn-42770.exe
712	Unicorn-42770.exe
2148	Unicorn-22904.exe
2300	Unicorn-42770.exe
2652	Unicorn-42313.exe
2700	Unicorn-33647.exe
3020	Unicorn-42578.exe
2040	Unicorn-36448.exe
2856	Unicorn-22712.exe
2780	Unicorn-45339.exe
2588	Unicorn-45894.exe
2576	Unicorn-58276.exe
2948	Unicorn-30.exe
2660	Unicorn-65302.exe
2076	Unicorn-2753.exe
2428	Unicorn-54555.exe
876	Unicorn-29496.exe
2912	Unicorn-8883.exe
2016	Unicorn-16541.exe
1064	Unicorn-22672.exe
3000	Unicorn-64067.exe
1864	Unicorn-26564.exe
1836	Unicorn-59407.exe
1160	Unicorn-13735.exe
1084	Unicorn-26734.exe
1316	Unicorn-46600.exe
272	Unicorn-40330.exe
1732	Unicorn-64280.exe
2988	Unicorn-64280.exe
1736	Unicorn-2058.exe
2328	Unicorn-27524.exe
1848	Unicorn-63823.exe
1204	Unicorn-64088.exe
2708	Unicorn-14887.exe
2824	Unicorn-21201.exe
2840	Unicorn-42714.exe
1572	Unicorn-61850.exe
2068	Unicorn-7274.exe
2412	Unicorn-699.exe
1104	Unicorn-57571.exe
2440	Unicorn-964.exe
1164	Unicorn-964.exe

Loads dropped DLL 64 IoCs

pid	Process
2668	46f627575391f18082046dfa4e7b0e80aed62b12ad1097dd1bcdea7f50c0cf9aN.exe
2668	46f627575391f18082046dfa4e7b0e80aed62b12ad1097dd1bcdea7f50c0cf9aN.exe
2772	Unicorn-51405.exe
2668	46f627575391f18082046dfa4e7b0e80aed62b12ad1097dd1bcdea7f50c0cf9aN.exe
2772	Unicorn-51405.exe
2668	46f627575391f18082046dfa4e7b0e80aed62b12ad1097dd1bcdea7f50c0cf9aN.exe
2852	Unicorn-46226.exe
2852	Unicorn-46226.exe
2848	Unicorn-30444.exe
2848	Unicorn-30444.exe
2668	46f627575391f18082046dfa4e7b0e80aed62b12ad1097dd1bcdea7f50c0cf9aN.exe
2668	46f627575391f18082046dfa4e7b0e80aed62b12ad1097dd1bcdea7f50c0cf9aN.exe
2772	Unicorn-51405.exe
2772	Unicorn-51405.exe
2568	Unicorn-37347.exe
2568	Unicorn-37347.exe
2852	Unicorn-46226.exe
2852	Unicorn-46226.exe
1352	Unicorn-9443.exe
1352	Unicorn-9443.exe
2848	Unicorn-30444.exe
236	Unicorn-55529.exe
2848	Unicorn-30444.exe
236	Unicorn-55529.exe
2668	46f627575391f18082046dfa4e7b0e80aed62b12ad1097dd1bcdea7f50c0cf9aN.exe
2772	Unicorn-51405.exe
2668	46f627575391f18082046dfa4e7b0e80aed62b12ad1097dd1bcdea7f50c0cf9aN.exe
2772	Unicorn-51405.exe
1112	Unicorn-55115.exe
1112	Unicorn-55115.exe
2124	Unicorn-29117.exe
2124	Unicorn-29117.exe
2568	Unicorn-37347.exe
2568	Unicorn-37347.exe
2800	Unicorn-13335.exe
2800	Unicorn-13335.exe
2852	Unicorn-46226.exe
2852	Unicorn-46226.exe
2544	Unicorn-38629.exe
2544	Unicorn-38629.exe
1352	Unicorn-9443.exe
1352	Unicorn-9443.exe
1100	Unicorn-1872.exe
1100	Unicorn-1872.exe
236	Unicorn-55529.exe
236	Unicorn-55529.exe
536	Unicorn-52919.exe
1584	Unicorn-58784.exe
264	Unicorn-47544.exe
536	Unicorn-52919.exe
264	Unicorn-47544.exe
1584	Unicorn-58784.exe
2772	Unicorn-51405.exe
2772	Unicorn-51405.exe
2848	Unicorn-30444.exe
2668	46f627575391f18082046dfa4e7b0e80aed62b12ad1097dd1bcdea7f50c0cf9aN.exe
1112	Unicorn-55115.exe
2168	Unicorn-59049.exe
2668	46f627575391f18082046dfa4e7b0e80aed62b12ad1097dd1bcdea7f50c0cf9aN.exe
2168	Unicorn-59049.exe
2848	Unicorn-30444.exe
1112	Unicorn-55115.exe
1860	Unicorn-65354.exe
1860	Unicorn-65354.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
640	272	WerFault.exe	79
2444	3012	WerFault.exe	152

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33082.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13898.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21040.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8233.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59096.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44187.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18066.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2731.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13898.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13898.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48160.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23392.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10794.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34237.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24586.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51874.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23392.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7283.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18430.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24586.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49833.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60100.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21040.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45339.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41612.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16819.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14726.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16922.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12303.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39687.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10990.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50352.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38868.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63728.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38322.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13898.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41778.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44452.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24586.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37285.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63728.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64280.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14363.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8992.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24586.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53042.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50528.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42376.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38322.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24561.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4387.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64059.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30444.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24586.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60100.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46900.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10138.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21040.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15256.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56911.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61377.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39230.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56528.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29218.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2668	46f627575391f18082046dfa4e7b0e80aed62b12ad1097dd1bcdea7f50c0cf9aN.exe
2772	Unicorn-51405.exe
2852	Unicorn-46226.exe
2848	Unicorn-30444.exe
2568	Unicorn-37347.exe
1352	Unicorn-9443.exe
236	Unicorn-55529.exe
1112	Unicorn-55115.exe
2124	Unicorn-29117.exe
2800	Unicorn-13335.exe
2544	Unicorn-38629.exe
1100	Unicorn-1872.exe
536	Unicorn-52919.exe
1584	Unicorn-58784.exe
2168	Unicorn-59049.exe
264	Unicorn-47544.exe
1860	Unicorn-65354.exe
968	Unicorn-7283.exe
1380	Unicorn-62422.exe
2528	Unicorn-33834.exe
2500	Unicorn-9884.exe
1724	Unicorn-21560.exe
2088	Unicorn-16922.exe
712	Unicorn-42770.exe
2452	Unicorn-42770.exe
2300	Unicorn-42770.exe
2148	Unicorn-22904.exe
2652	Unicorn-42313.exe
2700	Unicorn-33647.exe
2856	Unicorn-22712.exe
2040	Unicorn-36448.exe
2780	Unicorn-45339.exe
2588	Unicorn-45894.exe
2576	Unicorn-58276.exe
2076	Unicorn-2753.exe
2948	Unicorn-30.exe
2660	Unicorn-65302.exe
2428	Unicorn-54555.exe
2912	Unicorn-8883.exe
876	Unicorn-29496.exe
2016	Unicorn-16541.exe
1064	Unicorn-22672.exe
3000	Unicorn-64067.exe
1864	Unicorn-26564.exe
1160	Unicorn-13735.exe
1836	Unicorn-59407.exe
1316	Unicorn-46600.exe
1084	Unicorn-26734.exe
1732	Unicorn-64280.exe
2988	Unicorn-64280.exe
2824	Unicorn-21201.exe
2328	Unicorn-27524.exe
1848	Unicorn-63823.exe
1736	Unicorn-2058.exe
2708	Unicorn-14887.exe
1204	Unicorn-64088.exe
2840	Unicorn-42714.exe
1080	Unicorn-2443.exe
1572	Unicorn-61850.exe
2068	Unicorn-7274.exe
2412	Unicorn-699.exe
1104	Unicorn-57571.exe
2440	Unicorn-964.exe
1164	Unicorn-964.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 2772	2668	46f627575391f18082046dfa4e7b0e80aed62b12ad1097dd1bcdea7f50c0cf9aN.exe	31
PID 2668 wrote to memory of 2772	2668	46f627575391f18082046dfa4e7b0e80aed62b12ad1097dd1bcdea7f50c0cf9aN.exe	31
PID 2668 wrote to memory of 2772	2668	46f627575391f18082046dfa4e7b0e80aed62b12ad1097dd1bcdea7f50c0cf9aN.exe	31
PID 2668 wrote to memory of 2772	2668	46f627575391f18082046dfa4e7b0e80aed62b12ad1097dd1bcdea7f50c0cf9aN.exe	31
PID 2772 wrote to memory of 2852	2772	Unicorn-51405.exe	32
PID 2772 wrote to memory of 2852	2772	Unicorn-51405.exe	32
PID 2772 wrote to memory of 2852	2772	Unicorn-51405.exe	32
PID 2772 wrote to memory of 2852	2772	Unicorn-51405.exe	32
PID 2668 wrote to memory of 2848	2668	46f627575391f18082046dfa4e7b0e80aed62b12ad1097dd1bcdea7f50c0cf9aN.exe	33
PID 2668 wrote to memory of 2848	2668	46f627575391f18082046dfa4e7b0e80aed62b12ad1097dd1bcdea7f50c0cf9aN.exe	33
PID 2668 wrote to memory of 2848	2668	46f627575391f18082046dfa4e7b0e80aed62b12ad1097dd1bcdea7f50c0cf9aN.exe	33
PID 2668 wrote to memory of 2848	2668	46f627575391f18082046dfa4e7b0e80aed62b12ad1097dd1bcdea7f50c0cf9aN.exe	33
PID 2852 wrote to memory of 2568	2852	Unicorn-46226.exe	34
PID 2852 wrote to memory of 2568	2852	Unicorn-46226.exe	34
PID 2852 wrote to memory of 2568	2852	Unicorn-46226.exe	34
PID 2852 wrote to memory of 2568	2852	Unicorn-46226.exe	34
PID 2848 wrote to memory of 1352	2848	Unicorn-30444.exe	35
PID 2848 wrote to memory of 1352	2848	Unicorn-30444.exe	35
PID 2848 wrote to memory of 1352	2848	Unicorn-30444.exe	35
PID 2848 wrote to memory of 1352	2848	Unicorn-30444.exe	35
PID 2668 wrote to memory of 236	2668	46f627575391f18082046dfa4e7b0e80aed62b12ad1097dd1bcdea7f50c0cf9aN.exe	36
PID 2668 wrote to memory of 236	2668	46f627575391f18082046dfa4e7b0e80aed62b12ad1097dd1bcdea7f50c0cf9aN.exe	36
PID 2668 wrote to memory of 236	2668	46f627575391f18082046dfa4e7b0e80aed62b12ad1097dd1bcdea7f50c0cf9aN.exe	36
PID 2668 wrote to memory of 236	2668	46f627575391f18082046dfa4e7b0e80aed62b12ad1097dd1bcdea7f50c0cf9aN.exe	36
PID 2772 wrote to memory of 1112	2772	Unicorn-51405.exe	37
PID 2772 wrote to memory of 1112	2772	Unicorn-51405.exe	37
PID 2772 wrote to memory of 1112	2772	Unicorn-51405.exe	37
PID 2772 wrote to memory of 1112	2772	Unicorn-51405.exe	37
PID 2568 wrote to memory of 2124	2568	Unicorn-37347.exe	38
PID 2568 wrote to memory of 2124	2568	Unicorn-37347.exe	38
PID 2568 wrote to memory of 2124	2568	Unicorn-37347.exe	38
PID 2568 wrote to memory of 2124	2568	Unicorn-37347.exe	38
PID 2852 wrote to memory of 2800	2852	Unicorn-46226.exe	39
PID 2852 wrote to memory of 2800	2852	Unicorn-46226.exe	39
PID 2852 wrote to memory of 2800	2852	Unicorn-46226.exe	39
PID 2852 wrote to memory of 2800	2852	Unicorn-46226.exe	39
PID 1352 wrote to memory of 2544	1352	Unicorn-9443.exe	40
PID 1352 wrote to memory of 2544	1352	Unicorn-9443.exe	40
PID 1352 wrote to memory of 2544	1352	Unicorn-9443.exe	40
PID 1352 wrote to memory of 2544	1352	Unicorn-9443.exe	40
PID 2848 wrote to memory of 264	2848	Unicorn-30444.exe	41
PID 2848 wrote to memory of 264	2848	Unicorn-30444.exe	41
PID 2848 wrote to memory of 264	2848	Unicorn-30444.exe	41
PID 2848 wrote to memory of 264	2848	Unicorn-30444.exe	41
PID 236 wrote to memory of 1100	236	Unicorn-55529.exe	42
PID 236 wrote to memory of 1100	236	Unicorn-55529.exe	42
PID 236 wrote to memory of 1100	236	Unicorn-55529.exe	42
PID 236 wrote to memory of 1100	236	Unicorn-55529.exe	42
PID 2668 wrote to memory of 1584	2668	46f627575391f18082046dfa4e7b0e80aed62b12ad1097dd1bcdea7f50c0cf9aN.exe	43
PID 2668 wrote to memory of 1584	2668	46f627575391f18082046dfa4e7b0e80aed62b12ad1097dd1bcdea7f50c0cf9aN.exe	43
PID 2668 wrote to memory of 1584	2668	46f627575391f18082046dfa4e7b0e80aed62b12ad1097dd1bcdea7f50c0cf9aN.exe	43
PID 2668 wrote to memory of 1584	2668	46f627575391f18082046dfa4e7b0e80aed62b12ad1097dd1bcdea7f50c0cf9aN.exe	43
PID 2772 wrote to memory of 536	2772	Unicorn-51405.exe	44
PID 2772 wrote to memory of 536	2772	Unicorn-51405.exe	44
PID 2772 wrote to memory of 536	2772	Unicorn-51405.exe	44
PID 2772 wrote to memory of 536	2772	Unicorn-51405.exe	44
PID 1112 wrote to memory of 2168	1112	Unicorn-55115.exe	45
PID 1112 wrote to memory of 2168	1112	Unicorn-55115.exe	45
PID 1112 wrote to memory of 2168	1112	Unicorn-55115.exe	45
PID 1112 wrote to memory of 2168	1112	Unicorn-55115.exe	45
PID 2124 wrote to memory of 1860	2124	Unicorn-29117.exe	46
PID 2124 wrote to memory of 1860	2124	Unicorn-29117.exe	46
PID 2124 wrote to memory of 1860	2124	Unicorn-29117.exe	46
PID 2124 wrote to memory of 1860	2124	Unicorn-29117.exe	46

C:\Users\Admin\AppData\Local\Temp\46f627575391f18082046dfa4e7b0e80aed62b12ad1097dd1bcdea7f50c0cf9aN.exe
"C:\Users\Admin\AppData\Local\Temp\46f627575391f18082046dfa4e7b0e80aed62b12ad1097dd1bcdea7f50c0cf9aN.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51405.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51405.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46226.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46226.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37347.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37347.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29117.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65354.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45339.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-964.exe
        8⤵
        
        PID:2796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6003.exe
        9⤵
        
        PID:2968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24586.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13898.exe
        9⤵
        
        PID:888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21040.exe
        9⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51675.exe
        8⤵
        
        PID:2308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18743.exe
        8⤵
        
        PID:3772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39687.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61377.exe
        8⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46636.exe
        7⤵
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8992.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29075.exe
        8⤵
        
        PID:3148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42295.exe
        8⤵
        
        PID:2060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14726.exe
        8⤵
        
        PID:6876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43703.exe
        7⤵
        
        PID:2340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16003.exe
        7⤵
        
        PID:3760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36754.exe
        7⤵
        
        PID:1612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15256.exe
        7⤵
        
        PID:6916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45894.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4856.exe
        7⤵
        
        PID:2356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27492.exe
        8⤵
        
        PID:1620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44452.exe
        9⤵
        
        PID:3820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-163.exe
        9⤵
        
        PID:4520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23392.exe
        9⤵
        
        PID:6544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38322.exe
        8⤵
        
        PID:3468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19763.exe
        8⤵
        
        PID:2108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12375.exe
        8⤵
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39230.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1124.exe
        8⤵
        
        PID:6844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38322.exe
        7⤵
        
        PID:3460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19763.exe
        7⤵
        
        PID:5008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12375.exe
        7⤵
        
        PID:5968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60371.exe
        6⤵
        
        PID:2812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8992.exe
        7⤵
        
        PID:988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29075.exe
        7⤵
        
        PID:4068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10774.exe
        7⤵
        
        PID:4700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14726.exe
        7⤵
        
        PID:6788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49568.exe
        6⤵
        
        PID:3016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7338.exe
        6⤵
        
        PID:3300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20219.exe
        6⤵
        
        PID:4928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59262.exe
        6⤵
        
        PID:6884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9884.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8883.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6693.exe
        7⤵
        
        PID:1924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42376.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24586.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13898.exe
        8⤵
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21040.exe
        8⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30294.exe
        7⤵
        
        PID:548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56528.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33401.exe
        8⤵
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57599.exe
        8⤵
        
        PID:7020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38322.exe
        7⤵
        
        PID:3484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19763.exe
        7⤵
        
        PID:5084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12375.exe
        7⤵
        
        PID:6084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41612.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27701.exe
        7⤵
        
        PID:3944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13481.exe
        7⤵
        
        PID:4976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53042.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21040.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26038.exe
        6⤵
        
        PID:3688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47965.exe
        6⤵
        
        PID:4836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64959.exe
        6⤵
        
        PID:5472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61377.exe
        6⤵
        
        PID:5564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2753.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4856.exe
        6⤵
        
        PID:1992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-191.exe
        7⤵
        
        PID:2160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64680.exe
        8⤵
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46379.exe
        8⤵
        
        PID:4936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21040.exe
        8⤵
        
        PID:5692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12334.exe
        7⤵
        
        PID:3956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13898.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21040.exe
        7⤵
        
        PID:5944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13190.exe
        6⤵
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17461.exe
        7⤵
        
        PID:6964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38322.exe
        6⤵
        
        PID:3500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19763.exe
        6⤵
        
        PID:5100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12375.exe
        6⤵
        
        PID:6076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-699.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24561.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24586.exe
        6⤵
        
        PID:3624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13898.exe
        6⤵
        
        PID:1752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21040.exe
        6⤵
        
        PID:5328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62.exe
        5⤵
        
        PID:2376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59080.exe
        5⤵
        
        PID:3968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56361.exe
        5⤵
        
        PID:4816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56911.exe
        5⤵
        
        PID:5292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13335.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13335.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33834.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14315.exe
        6⤵
        
        PID:2612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60757.exe
        7⤵
        
        PID:3556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65121.exe
        7⤵
        
        PID:4704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6306.exe
        7⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21040.exe
        7⤵
        
        PID:5804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31904.exe
        6⤵
        
        PID:3604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10519.exe
        6⤵
        
        PID:4692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60676.exe
        6⤵
        
        PID:5488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41686.exe
        6⤵
        
        PID:6304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64263.exe
        5⤵
        
        PID:2900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6003.exe
        6⤵
        
        PID:1468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24586.exe
        6⤵
        
        PID:3552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13898.exe
        6⤵
        
        PID:4560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14726.exe
        6⤵
        
        PID:6692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46579.exe
        5⤵
        
        PID:2960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35521.exe
        5⤵
        
        PID:3348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60100.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-653.exe
        5⤵
        
        PID:5812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7283.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7283.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58276.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-964.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13787.exe
        7⤵
        
        PID:2492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50055.exe
        8⤵
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24586.exe
        7⤵
        
        PID:3548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13898.exe
        7⤵
        
        PID:4992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21040.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22510.exe
        6⤵
        
        PID:1252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2234.exe
        7⤵
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46796.exe
        7⤵
        
        PID:6800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38322.exe
        6⤵
        
        PID:3444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19763.exe
        6⤵
        
        PID:4108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12375.exe
        6⤵
        
        PID:1384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50528.exe
        5⤵
        
        PID:2876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18234.exe
        6⤵
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44452.exe
        7⤵
        
        PID:3800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-163.exe
        7⤵
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23392.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38322.exe
        6⤵
        
        PID:3408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19763.exe
        6⤵
        
        PID:4432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63728.exe
        6⤵
        
        PID:6684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3900.exe
        5⤵
        
        PID:2992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44452.exe
        6⤵
        
        PID:3892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-163.exe
        6⤵
        
        PID:4624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23392.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31904.exe
        5⤵
        
        PID:3628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39300.exe
        5⤵
        
        PID:4808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52508.exe
        5⤵
        
        PID:5400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12905.exe
        5⤵
        
        PID:5932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65302.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4856.exe
        5⤵
        
        PID:1580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46652.exe
        6⤵
        
        PID:2248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24586.exe
        6⤵
        
        PID:3592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13898.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14726.exe
        6⤵
        
        PID:6620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42930.exe
        5⤵
        
        PID:1072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19656.exe
        6⤵
        
        PID:6156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38322.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19763.exe
        5⤵
        
        PID:4148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12375.exe
        5⤵
        
        PID:6036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57571.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8992.exe
        5⤵
        
        PID:2004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29075.exe
        5⤵
        
        PID:3768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58631.exe
        5⤵
        
        PID:4760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21040.exe
        5⤵
        
        PID:6048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49063.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49063.exe
      4⤵
      PID:1648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15946.exe
        5⤵
        
        PID:7120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10608.exe
      4⤵
      PID:3908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18494.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18494.exe
      4⤵
      PID:5032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51576.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51576.exe
      4⤵
      PID:5916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55115.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55115.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59049.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59049.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42578.exe
        5⤵
        Executes dropped EXE
        
        PID:3020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2443.exe
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18064.exe
        7⤵
        
        PID:2936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16819.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47475.exe
        8⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23392.exe
        8⤵
        
        PID:6700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24586.exe
        7⤵
        
        PID:3576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13898.exe
        7⤵
        
        PID:4104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21040.exe
        7⤵
        
        PID:5648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59459.exe
        6⤵
        
        PID:2264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38322.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50242.exe
        6⤵
        
        PID:5868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49124.exe
        6⤵
        
        PID:5828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7274.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14363.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6541.exe
        7⤵
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13993.exe
        7⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30427.exe
        7⤵
        
        PID:7068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24586.exe
        6⤵
        
        PID:3516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13898.exe
        6⤵
        
        PID:4168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14726.exe
        6⤵
        
        PID:6536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18430.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43378.exe
        6⤵
        
        PID:4544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53723.exe
        6⤵
        
        PID:5784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23392.exe
        6⤵
        
        PID:6852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44187.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11098.exe
        5⤵
        
        PID:4956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15256.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22712.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22712.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27524.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27301.exe
        6⤵
        
        PID:2084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24586.exe
        6⤵
        
        PID:3332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13898.exe
        6⤵
        
        PID:4196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14726.exe
        6⤵
        
        PID:6708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54664.exe
        5⤵
        
        PID:1804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26466.exe
        6⤵
        
        PID:4572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43053.exe
        6⤵
        
        PID:5512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63464.exe
        6⤵
        
        PID:7048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42811.exe
        5⤵
        
        PID:3188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4387.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63728.exe
        5⤵
        
        PID:6588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21201.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21201.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2246.exe
        5⤵
        
        PID:2608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44452.exe
        6⤵
        
        PID:3888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4247.exe
        6⤵
        
        PID:1680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15175.exe
        6⤵
        
        PID:5508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38322.exe
        5⤵
        
        PID:3316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50242.exe
        5⤵
        
        PID:5860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61377.exe
        5⤵
        
        PID:5584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42630.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42630.exe
      4⤵
      PID:2904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44452.exe
        5⤵
        
        PID:3792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-163.exe
        5⤵
        
        PID:4492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23392.exe
        5⤵
        
        PID:6556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23238.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23238.exe
      4⤵
      PID:3680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22764.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22764.exe
      4⤵
      PID:4848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65489.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65489.exe
      4⤵
      PID:5456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56911.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56911.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52919.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52919.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42770.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42770.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46600.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42376.exe
        6⤵
        
        PID:1980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24586.exe
        6⤵
        
        PID:3532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13898.exe
        6⤵
        
        PID:4468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14726.exe
        6⤵
        
        PID:6636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26210.exe
        5⤵
        
        PID:2332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38322.exe
        5⤵
        
        PID:3392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19763.exe
        5⤵
        
        PID:5060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12375.exe
        5⤵
        
        PID:5644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40330.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40330.exe
      4⤵
      Executes dropped EXE
      PID:272
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 272 -s 148
        5⤵
        Program crash
        
        PID:640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38296.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38296.exe
      4⤵
      PID:1020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59728.exe
        5⤵
        
        PID:7128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16003.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16003.exe
      4⤵
      PID:4052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24502.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24502.exe
      4⤵
      PID:4912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15256.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15256.exe
      4⤵
      PID:6908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42313.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42313.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64088.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64088.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24560.exe
        5⤵
        
        PID:1096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10138.exe
        5⤵
        
        PID:3796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4387.exe
        5⤵
        
        PID:4888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63728.exe
        5⤵
        
        PID:6580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54664.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54664.exe
      4⤵
      PID:2512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42811.exe
      4⤵
      PID:4056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16639.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16639.exe
      4⤵
      PID:4772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12375.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12375.exe
      4⤵
      PID:5616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42714.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42714.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56299.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56299.exe
      4⤵
      PID:1880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44452.exe
        5⤵
        
        PID:4036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-163.exe
        5⤵
        
        PID:4496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23392.exe
        5⤵
        
        PID:6660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12303.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12303.exe
      4⤵
      PID:3664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55421.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55421.exe
      4⤵
      PID:4872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8087.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8087.exe
      4⤵
      PID:5408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12375.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12375.exe
      4⤵
      PID:5260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10221.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10221.exe
    3⤵
    PID:2420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44452.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44452.exe
      4⤵
      PID:3836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-163.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-163.exe
      4⤵
      PID:4636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57599.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57599.exe
      4⤵
      PID:7028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23768.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23768.exe
    3⤵
    PID:3700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18299.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18299.exe
    3⤵
    PID:4856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42707.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42707.exe
    3⤵
    PID:5436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55776.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55776.exe
    3⤵
    PID:5276
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30444.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30444.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9443.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9443.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38629.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38629.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62422.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10284.exe
        7⤵
        
        PID:916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59096.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44452.exe
        9⤵
        
        PID:3764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64680.exe
        9⤵
        
        PID:4000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64059.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:4736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14726.exe
        9⤵
        
        PID:6644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24586.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13898.exe
        8⤵
        
        PID:932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14726.exe
        8⤵
        
        PID:6868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51208.exe
        7⤵
        
        PID:3396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9175.exe
        7⤵
        
        PID:4612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3390.exe
        7⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59262.exe
        7⤵
        
        PID:6892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55572.exe
        6⤵
        
        PID:2104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59475.exe
        7⤵
        
        PID:3168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37051.exe
        7⤵
        
        PID:3184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39555.exe
        7⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21040.exe
        7⤵
        
        PID:5808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53345.exe
        6⤵
        
        PID:3140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16003.exe
        6⤵
        
        PID:3296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13525.exe
        6⤵
        
        PID:5316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58261.exe
        6⤵
        
        PID:6812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54555.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19138.exe
        6⤵
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52023.exe
        7⤵
        
        PID:1788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40766.exe
        8⤵
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49173.exe
        8⤵
        
        PID:7100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12303.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42100.exe
        7⤵
        
        PID:4792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28591.exe
        7⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63728.exe
        7⤵
        
        PID:6668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49646.exe
        6⤵
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46900.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41991.exe
        6⤵
        
        PID:3872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33082.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50242.exe
        6⤵
        
        PID:5852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61377.exe
        6⤵
        
        PID:5376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4647.exe
        5⤵
        
        PID:2692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35687.exe
        6⤵
        
        PID:2164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44452.exe
        7⤵
        
        PID:3784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-163.exe
        7⤵
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15175.exe
        7⤵
        
        PID:5580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34237.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19763.exe
        6⤵
        
        PID:4184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63728.exe
        6⤵
        
        PID:6796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44550.exe
        5⤵
        
        PID:2024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28965.exe
        6⤵
        
        PID:5300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1248.exe
        6⤵
        
        PID:6408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10794.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7881.exe
        5⤵
        
        PID:5024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50772.exe
        5⤵
        
        PID:5936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20155.exe
        5⤵
        
        PID:6312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21560.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21560.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29496.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-964.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37140.exe
        7⤵
        
        PID:2632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44452.exe
        8⤵
        
        PID:4020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-163.exe
        8⤵
        
        PID:4552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23392.exe
        8⤵
        
        PID:6572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24586.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13898.exe
        7⤵
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14726.exe
        7⤵
        
        PID:6596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2282.exe
        6⤵
        
        PID:684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38322.exe
        6⤵
        
        PID:3436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19763.exe
        6⤵
        
        PID:4984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12375.exe
        6⤵
        
        PID:5736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50528.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27492.exe
        6⤵
        
        PID:1716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10138.exe
        6⤵
        
        PID:4064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8471.exe
        6⤵
        
        PID:2740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41156.exe
        6⤵
        
        PID:6320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21170.exe
        5⤵
        
        PID:2656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44187.exe
        5⤵
        
        PID:3376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11098.exe
        5⤵
        
        PID:5108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61377.exe
        5⤵
        
        PID:5984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16541.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16541.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61836.exe
        5⤵
        
        PID:1796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34237.exe
        5⤵
        
        PID:3308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19763.exe
        5⤵
        
        PID:4444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63728.exe
        5⤵
        
        PID:6828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61379.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61379.exe
      4⤵
      PID:2132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44452.exe
        5⤵
        
        PID:3828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-163.exe
        5⤵
        
        PID:4464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23392.exe
        5⤵
        
        PID:6716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23269.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23269.exe
      4⤵
      PID:3952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60100.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12905.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12905.exe
      4⤵
      PID:5992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47544.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47544.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42770.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42770.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13735.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-959.exe
        6⤵
        
        PID:3012
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3012 -s 188
        7⤵
        Program crash
        
        PID:2444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24586.exe
        6⤵
        
        PID:3568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13898.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14726.exe
        6⤵
        
        PID:6628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55759.exe
        5⤵
        
        PID:2560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38322.exe
        5⤵
        
        PID:3476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19763.exe
        5⤵
        
        PID:5052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12375.exe
        5⤵
        
        PID:6060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26734.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26734.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59994.exe
        5⤵
        
        PID:1784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11172.exe
        6⤵
        
        PID:3912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13481.exe
        6⤵
        
        PID:4996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53042.exe
        6⤵
        
        PID:5956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14726.exe
        6⤵
        
        PID:6612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1011.exe
        5⤵
        
        PID:4044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39469.exe
        5⤵
        
        PID:4480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18066.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12375.exe
        5⤵
        
        PID:5344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59210.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59210.exe
      4⤵
      PID:3176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47987.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47987.exe
      4⤵
      PID:4112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20219.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20219.exe
      4⤵
      PID:5140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12905.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12905.exe
      4⤵
      PID:5544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36448.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36448.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64280.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64280.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59096.exe
        5⤵
        
        PID:1516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52589.exe
        6⤵
        
        PID:3520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65121.exe
        6⤵
        
        PID:4712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18641.exe
        6⤵
        
        PID:5652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49821.exe
        6⤵
        
        PID:6368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52952.exe
        5⤵
        
        PID:3740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27216.exe
        5⤵
        
        PID:5036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58907.exe
        5⤵
        
        PID:5948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63728.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53345.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53345.exe
      4⤵
      PID:3124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16003.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16003.exe
      4⤵
      PID:4072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28586.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28586.exe
      4⤵
      PID:4900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24620.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24620.exe
      4⤵
      PID:6296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63823.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63823.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47550.exe
      4⤵
      PID:3056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2106.exe
        5⤵
        
        PID:3196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9043.exe
        5⤵
        
        PID:4944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58907.exe
        5⤵
        
        PID:5904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12375.exe
        5⤵
        
        PID:5596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47778.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47778.exe
      4⤵
      PID:3160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10138.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48160.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48160.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12375.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12375.exe
      4⤵
      PID:6040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35495.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35495.exe
    3⤵
    PID:2140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51944.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51944.exe
      4⤵
      PID:6996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31451.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31451.exe
    3⤵
    PID:4128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37285.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37285.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56911.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56911.exe
    3⤵
    PID:5308
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55529.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55529.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1872.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1872.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16922.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16922.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22672.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4856.exe
        6⤵
        
        PID:2928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14363.exe
        7⤵
        
        PID:772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24586.exe
        7⤵
        
        PID:3616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13898.exe
        7⤵
        
        PID:2152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21040.exe
        7⤵
        
        PID:5776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4695.exe
        6⤵
        
        PID:900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23871.exe
        7⤵
        
        PID:3260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61940.exe
        7⤵
        
        PID:4076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64059.exe
        7⤵
        
        PID:4740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14726.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46651.exe
        6⤵
        
        PID:3424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17840.exe
        6⤵
        
        PID:4604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38221.exe
        6⤵
        
        PID:5452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10337.exe
        6⤵
        
        PID:6376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30107.exe
        5⤵
        
        PID:1548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10990.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56865.exe
        7⤵
        
        PID:3452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65121.exe
        7⤵
        
        PID:4672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6306.exe
        7⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21040.exe
        7⤵
        
        PID:5752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4327.exe
        6⤵
        
        PID:3492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13319.exe
        6⤵
        
        PID:4660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12171.exe
        6⤵
        
        PID:5348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12375.exe
        6⤵
        
        PID:6108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55706.exe
        5⤵
        
        PID:2196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64680.exe
        6⤵
        
        PID:3988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22390.exe
        6⤵
        
        PID:5268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57731.exe
        6⤵
        
        PID:6780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20611.exe
        5⤵
        
        PID:4028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36668.exe
        5⤵
        
        PID:4460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25538.exe
        5⤵
        
        PID:5832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12905.exe
        5⤵
        
        PID:352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64067.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64067.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58520.exe
        5⤵
        
        PID:2808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24586.exe
        5⤵
        
        PID:3620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13898.exe
        5⤵
        
        PID:5092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21040.exe
        5⤵
        
        PID:5996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65410.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65410.exe
      4⤵
      PID:2584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44452.exe
        5⤵
        
        PID:3852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-163.exe
        5⤵
        
        PID:4512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23392.exe
        5⤵
        
        PID:6732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44187.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44187.exe
      4⤵
      PID:3372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33706.exe
      4⤵
      PID:5880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12905.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12905.exe
      4⤵
      PID:5676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22904.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22904.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14887.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44815.exe
        5⤵
        
        PID:1720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40939.exe
        6⤵
        
        PID:4748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29218.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23392.exe
        6⤵
        
        PID:6564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12111.exe
        5⤵
        
        PID:3840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41463.exe
        5⤵
        
        PID:4744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60481.exe
        5⤵
        
        PID:5612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38263.exe
        5⤵
        
        PID:7036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41778.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41778.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44452.exe
        5⤵
        
        PID:3860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-163.exe
        5⤵
        
        PID:4620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15175.exe
        5⤵
        
        PID:5464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26069.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26069.exe
      4⤵
      PID:3928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19763.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19763.exe
      4⤵
      PID:4964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5207.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5207.exe
      4⤵
      PID:6292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61850.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61850.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50352.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50352.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24586.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24586.exe
      4⤵
      PID:3728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13898.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13898.exe
      4⤵
      PID:1700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14726.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14726.exe
      4⤵
      PID:6860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-694.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-694.exe
    3⤵
    PID:2100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35521.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35521.exe
    3⤵
    PID:3340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60100.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60100.exe
    3⤵
    PID:5068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12905.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12905.exe
    3⤵
    PID:5680
- C:\Users\Admin\AppData\Local\Temp\Unicorn-58784.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-58784.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42770.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42770.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26564.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26564.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33445.exe
        5⤵
        
        PID:836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2054.exe
        6⤵
        
        PID:2628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44452.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-739.exe
        7⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15175.exe
        7⤵
        
        PID:3044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12303.exe
        6⤵
        
        PID:3656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42100.exe
        6⤵
        
        PID:4820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24507.exe
        6⤵
        
        PID:5668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63728.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55702.exe
        5⤵
        
        PID:2748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44452.exe
        6⤵
        
        PID:3812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-163.exe
        6⤵
        
        PID:4488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23392.exe
        6⤵
        
        PID:6724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26038.exe
        5⤵
        
        PID:3672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47965.exe
        5⤵
        
        PID:4776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3506.exe
        5⤵
        
        PID:5364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61377.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43703.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43703.exe
      4⤵
      PID:2352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6003.exe
        5⤵
        
        PID:1828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24586.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13898.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14726.exe
        5⤵
        
        PID:6748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8233.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8233.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36750.exe
        5⤵
        
        PID:6956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44187.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44187.exe
      4⤵
      PID:3324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11098.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11098.exe
      4⤵
      PID:5072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61377.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61377.exe
      4⤵
      PID:5636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59407.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59407.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38868.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38868.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24586.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24586.exe
      4⤵
      PID:3636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13898.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13898.exe
      4⤵
      PID:624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14726.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14726.exe
      4⤵
      PID:6756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30874.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30874.exe
    3⤵
    PID:2224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44452.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44452.exe
      4⤵
      PID:3900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31138.exe
      4⤵
      PID:5840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2731.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2731.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44187.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44187.exe
    3⤵
    PID:3384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11098.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11098.exe
    3⤵
    PID:4592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15256.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15256.exe
    3⤵
    PID:6924
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33647.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33647.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64280.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64280.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49833.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49833.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44452.exe
        5⤵
        
        PID:4012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-163.exe
        5⤵
        
        PID:4528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23392.exe
        5⤵
        
        PID:6820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22386.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22386.exe
      4⤵
      PID:4080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39555.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39555.exe
      4⤵
      PID:5196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14726.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14726.exe
      4⤵
      PID:6604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8971.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8971.exe
    3⤵
    PID:2400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50787.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50787.exe
    3⤵
    PID:3288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45420.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45420.exe
    3⤵
    PID:5160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41156.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41156.exe
    3⤵
    PID:6336
- C:\Users\Admin\AppData\Local\Temp\Unicorn-2058.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-2058.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49833.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49833.exe
    3⤵
    PID:2784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44857.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44857.exe
      4⤵
      PID:3268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33795.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33795.exe
      4⤵
      PID:5280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43956.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43956.exe
      4⤵
      PID:6360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61940.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61940.exe
    3⤵
    PID:4008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10774.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10774.exe
    3⤵
    PID:4724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21040.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21040.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5792
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16352.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16352.exe
  2⤵
  PID:2760
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51874.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51874.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3964
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29495.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29495.exe
  2⤵
  PID:4868
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55776.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55776.exe
  2⤵
  PID:5732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-1872.exe

Filesize
468KB

MD5
a7c34da316cbac69888c3d12f5cac037

SHA1
a47c45c000b5bb06e21793c91ad28bc1b0ed1e5b

SHA256
15c918c089bd1453bf81173d7e67ba2025f353053cd8fdf43055e54cef856780

SHA512
dde9990c248160fc5d22d22092f3d5b692c02848bf75d6471eaf877aebbe7a00638ca55f34892d4ac4448f4848f665bafa06dbd4a594e635c0d408531a4171d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30444.exe

Filesize
468KB

MD5
55c272c2cc6be7f3728ddde68fa45efe

SHA1
fbb69166401d05b83b3c970ee298f6d2bdbee934

SHA256
1b021caacd7f761702440eb743eaa4200ce9ca10f7afe61305ebe3e74c8cf199

SHA512
2d6ade1ce40e404a1982dfd1eacce0c76460e4f0b5ba97aef098b2b2a2956c1e4019b8db7fbd388c5647d4efd2091156cc0b451a9112789fd5f44c358fd477e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38629.exe

Filesize
468KB

MD5
0ba95c3e7f59f672b46635097aaa13d3

SHA1
0021d5ec8159318afc7ab350a18fc50d2e1bb388

SHA256
31d884f995490c18215c3eb1a0d36b44579c7f56762f364ad583c69c56968a29

SHA512
1c08555af226c846e4a913fe8c08140be504eaaa83d48443802dca7e84ef3be5396306e0f366e0df5162154429722c020b0d74d96c5ab254af5d149e09bfe952

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47544.exe

Filesize
468KB

MD5
60909077a2f874c204a06c46929159ab

SHA1
0ae1c8a44697e4f5e56f3dd957e05ee821ea8dae

SHA256
90d62e1acf412ef7f02abc167a4ccba8d0238446ec0cee2ffb129ed233d18781

SHA512
3274631beae1258fa242b1d4d1c7cf9c4345d810ebde695a0d1e076856820fff53f4879db56a66af2e871c6125b8c197e5fc1c4549f8091504539c936897cd5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55115.exe

Filesize
468KB

MD5
5724eb35c6a0fcdea46de0c772cd11fc

SHA1
230dd430425a084b1378385f09d7384fe4fd931b

SHA256
fb1d1d83f566d7e87aaf076d32895e613f351da3dcfe0c033cf2f8131e1890ef

SHA512
072319f6418024f9cd888b78ecf33a6df5a1fd5a20a5b205d2117298e0362d7f66c0f9642d09e38ea741f6a8453f618f34b22900eb4c32d3fbc1728eae796e0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55529.exe

Filesize
468KB

MD5
d8718ea89ffbd900e46e2b844e74f406

SHA1
4f9e6566de11e51043e0302e2bf2437ff6613d87

SHA256
dfd8ac6b2463793a383e25b8f658051f26a9bd0ea1e3487247a9bddc464dbe24

SHA512
7e4308136fffb98a29dc41a6c567f2cabc142f939880316e1607ffe88ada648db3e4878517d9d0e3b5c5d6c2c045474d49947a7a449ba0a6f09927288923bf2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59049.exe

Filesize
468KB

MD5
914d514abaa4829e601c85c82f299486

SHA1
d2ae033ee3076c4c090d90e8a79a5c20e9bf0e78

SHA256
95b75faba1bd6368789c193c3987f73077e36962da3d7867ecdfcd047d374102

SHA512
557c6edffa6faef602fae53a40b9923c6762e3e4bd7599645515e8394dbf5341c5a35f155dda35560686e00a4044270e77d776b3609680bce8298e9e1dc07f51

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-65354.exe

Filesize
468KB

MD5
2d10ac665d89c2505c8d9a9afcd9bd54

SHA1
64c9c120c05a28702a215da32cb5a8ac55cc69ca

SHA256
950c46f9dcccfc40340c5ed7c4fb38124c80e48665f504c00f0fdfcce104a9ee

SHA512
b9676c68d520acc85a78b3326c20698d7dee9c2bd4911711c1fcb27076a09951fb5cf334570338de98ed53b296df5e977c9fe8ae7f352ffe2f962bfc99f55e6a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-13335.exe

Filesize
468KB

MD5
9cc27f808006ba5e9bc2ffaa3cd970ad

SHA1
2254a21a8f470de41ea8f0b134bec0e3c1a49899

SHA256
52b2d12297f3595367f85a431330da1ad2b90bce4e1c3bacc8f1de5cd8a43f05

SHA512
f4a879cab6956b667da67e7782274b76e1a933295376f5791d8eabad8e4d48bdaf2363feae6233d20ca3a0679a2a8b7085d6573ecae5d523f2f728474ce30b0f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-29117.exe

Filesize
468KB

MD5
48f456e98dda69f15458910b2527fbaa

SHA1
63c3af9cf091c887c2591f6667c6d39b48bad90e

SHA256
c09c05d12d499e0c578b86b59f3bb6bd6943b5fe3c253126d89722790a29d3be

SHA512
a7e64f2148c488153e3dfedbc59709f51f785d0505486dc77e2f0eab7d1223adb6247777c119756cd8664e63168358e9758b0f88eeefbfad05c6af0db49232f6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-33834.exe

Filesize
468KB

MD5
0109d78aa5e6c6772c85592c7b08dc3f

SHA1
3a0d9ba9db577bded43b67a72929a5e6cb7b2cf0

SHA256
89358eb2c5379afc0bdcd18db5631f9c89a4204bcf2fa86acac67c6f4429cb15

SHA512
6180d7489a29f256378e5e170d33d83b1c048530c11281289dc26fb0c6554df807699827c17db37554ca3bb2691f8ab53fadadd43b4c790a7cdcedb624649b33

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-37347.exe

Filesize
468KB

MD5
119ca5689a3bedfbb64fdf0f80790806

SHA1
d64b92b3c754ffd53967ca3c5608a9cf576b3d17

SHA256
322795022d7b995ae968be56887bca92a46735c2facea102f10703960502bcd1

SHA512
77795bdf8afafd6bd8fbf025b9bca0836f1ce0b9603a2e9d683aef125ffb0bb9a0c3903c84bf428cc3f4ea16b37d51c169e838f047af2385e124783bf48e2238

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-46226.exe

Filesize
468KB

MD5
bb626295520cdd608c04bcd401083d95

SHA1
da13a9ec3f6cd389226bb27bdc7ea5921f45f3c7

SHA256
61cf4ff3077f93c30d04aef0117270331b91dd1e48f1fdef689d5fdc78a87cd4

SHA512
2cbda651e3bca5fa300315f5b15c09cc1185e4d9208021a16c0777120e54ed199efd82af629956b7415afa36a9829eb8f02dbe006d42495be7d7d684801fd7eb

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-51405.exe

Filesize
468KB

MD5
4dc069b6ee7fd8169756ab2e459e8acf

SHA1
638e9242d0f130e0889dd16ae33fdcc7633a0d6a

SHA256
524c28bbf9d0fbc4f030bbbd69967027781f1d4aaf3948479b0b9aa0f8c37726

SHA512
b1b7087c4cd3dab1e7dffc957b00256232dfdd6b7aa71220043e7b0b18cc61c086f38b7ad67d3247a8125859393943dcf98ae3d264d89ce67248737c0ba36d90

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-52919.exe

Filesize
468KB

MD5
42a96784dd31223f37f6261342392ec7

SHA1
2d36c3c9d93b5a99c29a7611935e2f4888c9478e

SHA256
77dddf3dc0d467918aea6597ea6504241c0491e6ac0c51452bcd652b2b65d87d

SHA512
438c8e719cc0d9bd576403a75329f4bb8eeca0fd3c3bd9ff4292cf38f9d28bbb684f71e6914941a93cf60050429b31b7aad6e2d45129da8ae457094266b4ae28

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-58784.exe

Filesize
468KB

MD5
81958863679f50277fc0b3e10db8677b

SHA1
2f6827208eb00769ae6de4730fd792cbecc0dbe7

SHA256
f4c43204088236604331a7da9467eaf02dfd884c4652b03edd73fa9c16b38c82

SHA512
34ce7d449fe3b85ef8ff0bfc6bbd24f7854e8a25de53df530a2344559d282825681e3387bd9ff8aa621c8e7f5b3a31e8ff61d7f5554a90e4e483f6a941be7651

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-7283.exe

Filesize
468KB

MD5
51d05556e38b4461e05cd3179df8de77

SHA1
745111a3ecb26b40e78a41a11fc4b55add0c84fd

SHA256
93b1fa22ddcf492be74cef0d01f130d922cc4a8341a51558eec3e2914750987e

SHA512
7cb01f449eb44665e984c1221042f7022cf37e7029ee36458bc2192178d61be1a386e176b5dccffffd27eb60078b47b4212fcd34008775b09c12bff7b411c827

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-9443.exe

Filesize
468KB

MD5
adac227bdf2ae843eef81a9f33dc590c

SHA1
aa94a1d020ce4ce54c98c7881e5181442c9dd475

SHA256
e0b30277d903bb7f870416481b6cb31947a2ab0bf23e93f77391c582c270287b

SHA512
ebc80d4af0bbc04bf6ea0c71100df6b9363e9756218fd79ba79244b208f13fc44d64048ca005b7f83bde4ba75209a94f7731b9eea6d94c39ed6906bba302cf58

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-9884.exe

Filesize
468KB

MD5
2e089be7ff2ad349c542f6c77bc304a1

SHA1
309846e780914612bcb7f7fe4e37654e07ad56e0

SHA256
bff8d67f8ea339e203b153c602756e1997144b41862b8db6d409054791ad0016

SHA512
4e1054589314bb3840020c1ab207492e081d86ecf51350b857c4123964dec47ee5321c7f5f29bd41512457fad8f4e43fbeaf921c9c338ef95dfe6d0e6437586d

Download Submit
memory/236-144-0x00000000024C0000-0x0000000002535000-memory.dmp

Filesize
468KB

Download
memory/236-279-0x00000000024C0000-0x0000000002535000-memory.dmp

Filesize
468KB

Download
memory/236-142-0x00000000024C0000-0x0000000002535000-memory.dmp

Filesize
468KB

Download
memory/264-281-0x0000000003440000-0x00000000034B5000-memory.dmp

Filesize
468KB

Download
memory/264-284-0x0000000002910000-0x0000000002985000-memory.dmp

Filesize
468KB

Download
memory/264-146-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/536-175-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/536-282-0x0000000002480000-0x00000000024F5000-memory.dmp

Filesize
468KB

Download
memory/536-286-0x0000000002480000-0x00000000024F5000-memory.dmp

Filesize
468KB

Download
memory/876-415-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/968-366-0x0000000000530000-0x00000000005A5000-memory.dmp

Filesize
468KB

Download
memory/968-234-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/968-365-0x0000000000530000-0x00000000005A5000-memory.dmp

Filesize
468KB

Download
memory/1100-268-0x0000000000790000-0x0000000000805000-memory.dmp

Filesize
468KB

Download
memory/1100-266-0x0000000000790000-0x0000000000805000-memory.dmp

Filesize
468KB

Download
memory/1100-145-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1112-320-0x00000000033D0000-0x0000000003445000-memory.dmp

Filesize
468KB

Download
memory/1112-180-0x00000000028A0000-0x0000000002915000-memory.dmp

Filesize
468KB

Download
memory/1112-178-0x00000000028A0000-0x0000000002915000-memory.dmp

Filesize
468KB

Download
memory/1112-317-0x00000000033D0000-0x0000000003445000-memory.dmp

Filesize
468KB

Download
memory/1352-253-0x0000000002980000-0x00000000029F5000-memory.dmp

Filesize
468KB

Download
memory/1352-257-0x0000000002980000-0x00000000029F5000-memory.dmp

Filesize
468KB

Download
memory/1352-67-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1380-382-0x0000000000380000-0x00000000003F5000-memory.dmp

Filesize
468KB

Download
memory/1380-384-0x0000000000380000-0x00000000003F5000-memory.dmp

Filesize
468KB

Download
memory/1380-244-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1584-280-0x0000000002520000-0x0000000002595000-memory.dmp

Filesize
468KB

Download
memory/1584-179-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1584-285-0x0000000002520000-0x0000000002595000-memory.dmp

Filesize
468KB

Download
memory/1724-258-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1724-409-0x0000000002690000-0x0000000002705000-memory.dmp

Filesize
468KB

Download
memory/1860-349-0x0000000002920000-0x0000000002995000-memory.dmp

Filesize
468KB

Download
memory/1860-348-0x0000000003450000-0x00000000034C5000-memory.dmp

Filesize
468KB

Download
memory/2076-398-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2088-269-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2124-356-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2124-199-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2124-200-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2124-105-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2124-357-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2148-287-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2168-181-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2168-319-0x0000000002580000-0x00000000025F5000-memory.dmp

Filesize
468KB

Download
memory/2168-324-0x0000000002580000-0x00000000025F5000-memory.dmp

Filesize
468KB

Download
memory/2428-406-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2452-283-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2500-215-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2528-226-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2544-242-0x0000000002750000-0x00000000027C5000-memory.dmp

Filesize
468KB

Download
memory/2544-238-0x0000000002750000-0x00000000027C5000-memory.dmp

Filesize
468KB

Download
memory/2544-403-0x0000000002750000-0x00000000027C5000-memory.dmp

Filesize
468KB

Download
memory/2544-404-0x0000000002750000-0x00000000027C5000-memory.dmp

Filesize
468KB

Download
memory/2544-121-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2568-397-0x0000000002620000-0x0000000002695000-memory.dmp

Filesize
468KB

Download
memory/2568-396-0x0000000002620000-0x0000000002695000-memory.dmp

Filesize
468KB

Download
memory/2568-212-0x0000000002620000-0x0000000002695000-memory.dmp

Filesize
468KB

Download
memory/2568-213-0x0000000002620000-0x0000000002695000-memory.dmp

Filesize
468KB

Download
memory/2568-104-0x0000000002620000-0x0000000002695000-memory.dmp

Filesize
468KB

Download
memory/2568-50-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2576-367-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2652-329-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2660-386-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2668-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2668-405-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2668-11-0x00000000028A0000-0x0000000002915000-memory.dmp

Filesize
468KB

Download
memory/2668-153-0x00000000033D0000-0x0000000003445000-memory.dmp

Filesize
468KB

Download
memory/2668-414-0x00000000028A0000-0x0000000002915000-memory.dmp

Filesize
468KB

Download
memory/2668-323-0x00000000033D0000-0x0000000003445000-memory.dmp

Filesize
468KB

Download
memory/2668-322-0x00000000033D0000-0x0000000003445000-memory.dmp

Filesize
468KB

Download
memory/2668-6-0x00000000033D0000-0x0000000003445000-memory.dmp

Filesize
468KB

Download
memory/2668-173-0x00000000033D0000-0x0000000003445000-memory.dmp

Filesize
468KB

Download
memory/2668-73-0x00000000028A0000-0x0000000002915000-memory.dmp

Filesize
468KB

Download
memory/2700-326-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2772-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2772-316-0x0000000001D70000-0x0000000001DE5000-memory.dmp

Filesize
468KB

Download
memory/2772-80-0x0000000001D70000-0x0000000001DE5000-memory.dmp

Filesize
468KB

Download
memory/2772-35-0x0000000001D70000-0x0000000001DE5000-memory.dmp

Filesize
468KB

Download
memory/2772-174-0x0000000001D70000-0x0000000001DE5000-memory.dmp

Filesize
468KB

Download
memory/2800-109-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2800-224-0x0000000002640000-0x00000000026B5000-memory.dmp

Filesize
468KB

Download
memory/2800-223-0x0000000002640000-0x00000000026B5000-memory.dmp

Filesize
468KB

Download
memory/2848-143-0x0000000002450000-0x00000000024C5000-memory.dmp

Filesize
468KB

Download
memory/2848-66-0x0000000002450000-0x00000000024C5000-memory.dmp

Filesize
468KB

Download
memory/2848-138-0x0000000002450000-0x00000000024C5000-memory.dmp

Filesize
468KB

Download
memory/2848-37-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2848-325-0x0000000002450000-0x00000000024C5000-memory.dmp

Filesize
468KB

Download
memory/2848-321-0x0000000002450000-0x00000000024C5000-memory.dmp

Filesize
468KB

Download
memory/2852-381-0x0000000001F60000-0x0000000001FD5000-memory.dmp

Filesize
468KB

Download
memory/2852-48-0x0000000001F60000-0x0000000001FD5000-memory.dmp

Filesize
468KB

Download
memory/2852-36-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2852-383-0x0000000001F60000-0x0000000001FD5000-memory.dmp

Filesize
468KB

Download
memory/2852-229-0x0000000001F60000-0x0000000001FD5000-memory.dmp

Filesize
468KB

Download
memory/2852-233-0x0000000001F60000-0x0000000001FD5000-memory.dmp

Filesize
468KB

Download
memory/2856-330-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2948-385-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3020-327-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download