910c0a4b1fa0c19fda60ec5421bd266714aa86767399eda94ff09df753ef86f7

Analysis

max time kernel
120s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25/09/2024, 10:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

910c0a4b1fa0c19fda60ec5421bd266714aa86767399eda94ff09df753ef86f7N.exe
Size

468KB
MD5

f848461aa36af947e3074058491a4b30
SHA1

3d906489b67cdb839a875d74cf628d34372be3ee
SHA256

910c0a4b1fa0c19fda60ec5421bd266714aa86767399eda94ff09df753ef86f7
SHA512

32a7131ef88890378b04d92ca730b16af0dc827374bfc3d7cab3d7f9290ce01a0f28a12a10c0f074cc91e9202987c023f23479add522a6edf9f01916facb0f05
SSDEEP

3072:thoIowLdjy8U6bYs5z52jf5EChj+IpO/vHdOVNjNI137SCO15lv:thDoYLU6P512jfU0MUNIFeCO1

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1432	Unicorn-46168.exe
2148	Unicorn-29806.exe
2340	Unicorn-50973.exe
2872	Unicorn-26957.exe
2728	Unicorn-60184.exe
2156	Unicorn-55545.exe
2616	Unicorn-57583.exe
2396	Unicorn-48576.exe
1084	Unicorn-36878.exe
936	Unicorn-25093.exe
2712	Unicorn-44959.exe
1652	Unicorn-53127.exe
1080	Unicorn-20071.exe
2968	Unicorn-13940.exe
1428	Unicorn-3277.exe
2044	Unicorn-42110.exe
2072	Unicorn-17414.exe
2516	Unicorn-19451.exe
276	Unicorn-45810.exe
2056	Unicorn-59908.exe
1548	Unicorn-31180.exe
1048	Unicorn-46962.exe
3028	Unicorn-46962.exe
3008	Unicorn-25587.exe
2220	Unicorn-14652.exe
2424	Unicorn-34518.exe
2216	Unicorn-26158.exe
2356	Unicorn-13448.exe
2120	Unicorn-13713.exe
2944	Unicorn-59385.exe
3048	Unicorn-59385.exe
2932	Unicorn-59261.exe
2888	Unicorn-63900.exe
2916	Unicorn-42733.exe
2892	Unicorn-42733.exe
2624	Unicorn-48716.exe
1972	Unicorn-31118.exe
2804	Unicorn-30372.exe
560	Unicorn-48607.exe
264	Unicorn-19080.exe
2940	Unicorn-15550.exe
2040	Unicorn-35416.exe
2196	Unicorn-39308.exe
2360	Unicorn-39043.exe
2376	Unicorn-39308.exe
2400	Unicorn-34959.exe
600	Unicorn-41154.exe
2936	Unicorn-22780.exe
1076	Unicorn-22780.exe
2832	Unicorn-59026.exe
1880	Unicorn-12426.exe
1560	Unicorn-32292.exe
2532	Unicorn-7595.exe
1068	Unicorn-32100.exe
1892	Unicorn-6634.exe
2544	Unicorn-42114.exe
2536	Unicorn-27309.exe
2800	Unicorn-27309.exe
2760	Unicorn-56687.exe
2920	Unicorn-2448.exe
2732	Unicorn-19355.exe
2656	Unicorn-35499.exe
2908	Unicorn-15633.exe
2016	Unicorn-53371.exe

Loads dropped DLL 64 IoCs

pid	Process
1908	910c0a4b1fa0c19fda60ec5421bd266714aa86767399eda94ff09df753ef86f7N.exe
1908	910c0a4b1fa0c19fda60ec5421bd266714aa86767399eda94ff09df753ef86f7N.exe
1432	Unicorn-46168.exe
1908	910c0a4b1fa0c19fda60ec5421bd266714aa86767399eda94ff09df753ef86f7N.exe
1432	Unicorn-46168.exe
1908	910c0a4b1fa0c19fda60ec5421bd266714aa86767399eda94ff09df753ef86f7N.exe
2148	Unicorn-29806.exe
2148	Unicorn-29806.exe
1432	Unicorn-46168.exe
1432	Unicorn-46168.exe
2340	Unicorn-50973.exe
2340	Unicorn-50973.exe
1908	910c0a4b1fa0c19fda60ec5421bd266714aa86767399eda94ff09df753ef86f7N.exe
1908	910c0a4b1fa0c19fda60ec5421bd266714aa86767399eda94ff09df753ef86f7N.exe
2872	Unicorn-26957.exe
2872	Unicorn-26957.exe
2148	Unicorn-29806.exe
2148	Unicorn-29806.exe
2156	Unicorn-55545.exe
2156	Unicorn-55545.exe
2340	Unicorn-50973.exe
2340	Unicorn-50973.exe
2728	Unicorn-60184.exe
2728	Unicorn-60184.exe
2616	Unicorn-57583.exe
1432	Unicorn-46168.exe
2616	Unicorn-57583.exe
1432	Unicorn-46168.exe
1908	910c0a4b1fa0c19fda60ec5421bd266714aa86767399eda94ff09df753ef86f7N.exe
1908	910c0a4b1fa0c19fda60ec5421bd266714aa86767399eda94ff09df753ef86f7N.exe
2396	Unicorn-48576.exe
2396	Unicorn-48576.exe
1084	Unicorn-36878.exe
1084	Unicorn-36878.exe
2148	Unicorn-29806.exe
2148	Unicorn-29806.exe
936	Unicorn-25093.exe
936	Unicorn-25093.exe
2340	Unicorn-50973.exe
2340	Unicorn-50973.exe
2872	Unicorn-26957.exe
2872	Unicorn-26957.exe
1428	Unicorn-3277.exe
1652	Unicorn-53127.exe
1428	Unicorn-3277.exe
1652	Unicorn-53127.exe
1908	910c0a4b1fa0c19fda60ec5421bd266714aa86767399eda94ff09df753ef86f7N.exe
1908	910c0a4b1fa0c19fda60ec5421bd266714aa86767399eda94ff09df753ef86f7N.exe
2728	Unicorn-60184.exe
2728	Unicorn-60184.exe
1080	Unicorn-20071.exe
1080	Unicorn-20071.exe
2712	Unicorn-44959.exe
2712	Unicorn-44959.exe
2968	Unicorn-13940.exe
1432	Unicorn-46168.exe
2968	Unicorn-13940.exe
1432	Unicorn-46168.exe
2616	Unicorn-57583.exe
2156	Unicorn-55545.exe
2616	Unicorn-57583.exe
2156	Unicorn-55545.exe
2072	Unicorn-17414.exe
2072	Unicorn-17414.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61496.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24050.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17054.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3480.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12745.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18610.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44451.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51772.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55254.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28658.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51932.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5399.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38186.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63241.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36878.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3277.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-470.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32787.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53361.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24548.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62214.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37439.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45123.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39360.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47803.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16033.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-567.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48576.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47082.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18610.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55486.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42733.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9945.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12745.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52831.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61351.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42733.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63235.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34981.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37693.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44383.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12745.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12745.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8140.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18610.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25093.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40023.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9156.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29381.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22918.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31180.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-470.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28530.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36295.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63900.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9415.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22918.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61573.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27937.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27165.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40480.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54077.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41895.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1908	910c0a4b1fa0c19fda60ec5421bd266714aa86767399eda94ff09df753ef86f7N.exe
1432	Unicorn-46168.exe
2148	Unicorn-29806.exe
2340	Unicorn-50973.exe
2872	Unicorn-26957.exe
2156	Unicorn-55545.exe
2728	Unicorn-60184.exe
2616	Unicorn-57583.exe
2396	Unicorn-48576.exe
1084	Unicorn-36878.exe
936	Unicorn-25093.exe
1652	Unicorn-53127.exe
2712	Unicorn-44959.exe
1080	Unicorn-20071.exe
1428	Unicorn-3277.exe
2968	Unicorn-13940.exe
2044	Unicorn-42110.exe
2072	Unicorn-17414.exe
2516	Unicorn-19451.exe
276	Unicorn-45810.exe
2056	Unicorn-59908.exe
1548	Unicorn-31180.exe
3028	Unicorn-46962.exe
1048	Unicorn-46962.exe
2220	Unicorn-14652.exe
3008	Unicorn-25587.exe
2424	Unicorn-34518.exe
2216	Unicorn-26158.exe
3048	Unicorn-59385.exe
2356	Unicorn-13448.exe
2120	Unicorn-13713.exe
2944	Unicorn-59385.exe
2888	Unicorn-63900.exe
2932	Unicorn-59261.exe
2916	Unicorn-42733.exe
2892	Unicorn-42733.exe
2624	Unicorn-48716.exe
1972	Unicorn-31118.exe
2804	Unicorn-30372.exe
560	Unicorn-48607.exe
2040	Unicorn-35416.exe
264	Unicorn-19080.exe
2940	Unicorn-15550.exe
2196	Unicorn-39308.exe
2360	Unicorn-39043.exe
2376	Unicorn-39308.exe
600	Unicorn-41154.exe
2936	Unicorn-22780.exe
2400	Unicorn-34959.exe
1076	Unicorn-22780.exe
1880	Unicorn-12426.exe
2832	Unicorn-59026.exe
1560	Unicorn-32292.exe
2532	Unicorn-7595.exe
1068	Unicorn-32100.exe
1892	Unicorn-6634.exe
2544	Unicorn-42114.exe
2800	Unicorn-27309.exe
2536	Unicorn-27309.exe
2760	Unicorn-56687.exe
2920	Unicorn-2448.exe
2732	Unicorn-19355.exe
2656	Unicorn-35499.exe
2908	Unicorn-15633.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 1432	1908	910c0a4b1fa0c19fda60ec5421bd266714aa86767399eda94ff09df753ef86f7N.exe	30
PID 1908 wrote to memory of 1432	1908	910c0a4b1fa0c19fda60ec5421bd266714aa86767399eda94ff09df753ef86f7N.exe	30
PID 1908 wrote to memory of 1432	1908	910c0a4b1fa0c19fda60ec5421bd266714aa86767399eda94ff09df753ef86f7N.exe	30
PID 1908 wrote to memory of 1432	1908	910c0a4b1fa0c19fda60ec5421bd266714aa86767399eda94ff09df753ef86f7N.exe	30
PID 1432 wrote to memory of 2148	1432	Unicorn-46168.exe	31
PID 1432 wrote to memory of 2148	1432	Unicorn-46168.exe	31
PID 1432 wrote to memory of 2148	1432	Unicorn-46168.exe	31
PID 1432 wrote to memory of 2148	1432	Unicorn-46168.exe	31
PID 1908 wrote to memory of 2340	1908	910c0a4b1fa0c19fda60ec5421bd266714aa86767399eda94ff09df753ef86f7N.exe	32
PID 1908 wrote to memory of 2340	1908	910c0a4b1fa0c19fda60ec5421bd266714aa86767399eda94ff09df753ef86f7N.exe	32
PID 1908 wrote to memory of 2340	1908	910c0a4b1fa0c19fda60ec5421bd266714aa86767399eda94ff09df753ef86f7N.exe	32
PID 1908 wrote to memory of 2340	1908	910c0a4b1fa0c19fda60ec5421bd266714aa86767399eda94ff09df753ef86f7N.exe	32
PID 2148 wrote to memory of 2872	2148	Unicorn-29806.exe	33
PID 2148 wrote to memory of 2872	2148	Unicorn-29806.exe	33
PID 2148 wrote to memory of 2872	2148	Unicorn-29806.exe	33
PID 2148 wrote to memory of 2872	2148	Unicorn-29806.exe	33
PID 1432 wrote to memory of 2728	1432	Unicorn-46168.exe	35
PID 1432 wrote to memory of 2728	1432	Unicorn-46168.exe	35
PID 1432 wrote to memory of 2728	1432	Unicorn-46168.exe	35
PID 1432 wrote to memory of 2728	1432	Unicorn-46168.exe	35
PID 2340 wrote to memory of 2156	2340	Unicorn-50973.exe	36
PID 2340 wrote to memory of 2156	2340	Unicorn-50973.exe	36
PID 2340 wrote to memory of 2156	2340	Unicorn-50973.exe	36
PID 2340 wrote to memory of 2156	2340	Unicorn-50973.exe	36
PID 1908 wrote to memory of 2616	1908	910c0a4b1fa0c19fda60ec5421bd266714aa86767399eda94ff09df753ef86f7N.exe	37
PID 1908 wrote to memory of 2616	1908	910c0a4b1fa0c19fda60ec5421bd266714aa86767399eda94ff09df753ef86f7N.exe	37
PID 1908 wrote to memory of 2616	1908	910c0a4b1fa0c19fda60ec5421bd266714aa86767399eda94ff09df753ef86f7N.exe	37
PID 1908 wrote to memory of 2616	1908	910c0a4b1fa0c19fda60ec5421bd266714aa86767399eda94ff09df753ef86f7N.exe	37
PID 2872 wrote to memory of 2396	2872	Unicorn-26957.exe	38
PID 2872 wrote to memory of 2396	2872	Unicorn-26957.exe	38
PID 2872 wrote to memory of 2396	2872	Unicorn-26957.exe	38
PID 2872 wrote to memory of 2396	2872	Unicorn-26957.exe	38
PID 2148 wrote to memory of 1084	2148	Unicorn-29806.exe	39
PID 2148 wrote to memory of 1084	2148	Unicorn-29806.exe	39
PID 2148 wrote to memory of 1084	2148	Unicorn-29806.exe	39
PID 2148 wrote to memory of 1084	2148	Unicorn-29806.exe	39
PID 2156 wrote to memory of 2712	2156	Unicorn-55545.exe	40
PID 2156 wrote to memory of 2712	2156	Unicorn-55545.exe	40
PID 2156 wrote to memory of 2712	2156	Unicorn-55545.exe	40
PID 2156 wrote to memory of 2712	2156	Unicorn-55545.exe	40
PID 2340 wrote to memory of 936	2340	Unicorn-50973.exe	41
PID 2340 wrote to memory of 936	2340	Unicorn-50973.exe	41
PID 2340 wrote to memory of 936	2340	Unicorn-50973.exe	41
PID 2340 wrote to memory of 936	2340	Unicorn-50973.exe	41
PID 2728 wrote to memory of 1652	2728	Unicorn-60184.exe	42
PID 2728 wrote to memory of 1652	2728	Unicorn-60184.exe	42
PID 2728 wrote to memory of 1652	2728	Unicorn-60184.exe	42
PID 2728 wrote to memory of 1652	2728	Unicorn-60184.exe	42
PID 2616 wrote to memory of 1080	2616	Unicorn-57583.exe	43
PID 2616 wrote to memory of 1080	2616	Unicorn-57583.exe	43
PID 2616 wrote to memory of 1080	2616	Unicorn-57583.exe	43
PID 2616 wrote to memory of 1080	2616	Unicorn-57583.exe	43
PID 1432 wrote to memory of 2968	1432	Unicorn-46168.exe	44
PID 1432 wrote to memory of 2968	1432	Unicorn-46168.exe	44
PID 1432 wrote to memory of 2968	1432	Unicorn-46168.exe	44
PID 1432 wrote to memory of 2968	1432	Unicorn-46168.exe	44
PID 1908 wrote to memory of 1428	1908	910c0a4b1fa0c19fda60ec5421bd266714aa86767399eda94ff09df753ef86f7N.exe	45
PID 1908 wrote to memory of 1428	1908	910c0a4b1fa0c19fda60ec5421bd266714aa86767399eda94ff09df753ef86f7N.exe	45
PID 1908 wrote to memory of 1428	1908	910c0a4b1fa0c19fda60ec5421bd266714aa86767399eda94ff09df753ef86f7N.exe	45
PID 1908 wrote to memory of 1428	1908	910c0a4b1fa0c19fda60ec5421bd266714aa86767399eda94ff09df753ef86f7N.exe	45
PID 2396 wrote to memory of 2044	2396	Unicorn-48576.exe	46
PID 2396 wrote to memory of 2044	2396	Unicorn-48576.exe	46
PID 2396 wrote to memory of 2044	2396	Unicorn-48576.exe	46
PID 2396 wrote to memory of 2044	2396	Unicorn-48576.exe	46

C:\Users\Admin\AppData\Local\Temp\910c0a4b1fa0c19fda60ec5421bd266714aa86767399eda94ff09df753ef86f7N.exe
"C:\Users\Admin\AppData\Local\Temp\910c0a4b1fa0c19fda60ec5421bd266714aa86767399eda94ff09df753ef86f7N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46168.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46168.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29806.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29806.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26957.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26957.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48576.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42110.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42733.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53371.exe
        8⤵
        Executes dropped EXE
        
        PID:2016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47082.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:1380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49500.exe
        9⤵
        
        PID:3312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58648.exe
        9⤵
        
        PID:5016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36295.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48981.exe
        8⤵
        
        PID:2300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52135.exe
        8⤵
        
        PID:3428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18610.exe
        8⤵
        
        PID:4176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36302.exe
        8⤵
        
        PID:5116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57818.exe
        7⤵
        
        PID:1772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17290.exe
        8⤵
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21246.exe
        8⤵
        
        PID:3332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21236.exe
        8⤵
        
        PID:4824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36302.exe
        8⤵
        
        PID:3416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22918.exe
        7⤵
        
        PID:2180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46851.exe
        7⤵
        
        PID:3912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32093.exe
        7⤵
        
        PID:4752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37923.exe
        7⤵
        
        PID:4924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31118.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35499.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38042.exe
        8⤵
        
        PID:268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45821.exe
        9⤵
        
        PID:3500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64547.exe
        9⤵
        
        PID:3232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47847.exe
        9⤵
        
        PID:4876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55473.exe
        8⤵
        
        PID:3212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12745.exe
        8⤵
        
        PID:4256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44968.exe
        8⤵
        
        PID:4964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50657.exe
        7⤵
        
        PID:1992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29049.exe
        8⤵
        
        PID:3060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27250.exe
        8⤵
        
        PID:3924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34893.exe
        8⤵
        
        PID:4736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37392.exe
        8⤵
        
        PID:1816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18450.exe
        7⤵
        
        PID:2384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6882.exe
        7⤵
        
        PID:3908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28658.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63234.exe
        7⤵
        
        PID:5148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34988.exe
        6⤵
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7147.exe
        7⤵
        
        PID:3956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43763.exe
        7⤵
        
        PID:4636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37453.exe
        7⤵
        
        PID:5460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28784.exe
        6⤵
        
        PID:428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38186.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13101.exe
        6⤵
        
        PID:4788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3050.exe
        6⤵
        
        PID:5124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31180.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39308.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15239.exe
        7⤵
        
        PID:780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54077.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12745.exe
        7⤵
        
        PID:4248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44968.exe
        7⤵
        
        PID:5072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48467.exe
        6⤵
        
        PID:3056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45123.exe
        6⤵
        
        PID:3132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32093.exe
        6⤵
        
        PID:4792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19767.exe
        6⤵
        
        PID:4956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7413.exe
        5⤵
        
        PID:1440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47803.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39258.exe
        6⤵
        
        PID:2312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57969.exe
        6⤵
        
        PID:4488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58768.exe
        6⤵
        
        PID:5212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26428.exe
        5⤵
        
        PID:2232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1907.exe
        5⤵
        
        PID:4040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63693.exe
        5⤵
        
        PID:4976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26495.exe
        5⤵
        
        PID:4936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36878.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36878.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17414.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59261.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19355.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62214.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64805.exe
        8⤵
        
        PID:3356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40759.exe
        8⤵
        
        PID:4744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52831.exe
        8⤵
        
        PID:4696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9183.exe
        7⤵
        
        PID:1980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40986.exe
        7⤵
        
        PID:3852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40759.exe
        7⤵
        
        PID:4768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-470.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15633.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2494.exe
        7⤵
        
        PID:1580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7507.exe
        7⤵
        
        PID:4016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12745.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24548.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41289.exe
        6⤵
        
        PID:2408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27108.exe
        6⤵
        
        PID:4052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9945.exe
        6⤵
        
        PID:3536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36103.exe
        6⤵
        
        PID:3176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5720.exe
        6⤵
        
        PID:5456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63900.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16231.exe
        6⤵
        
        PID:1960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29381.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37461.exe
        8⤵
        
        PID:3740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43935.exe
        8⤵
        
        PID:4004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43571.exe
        8⤵
        
        PID:5076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3916.exe
        7⤵
        
        PID:3492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27822.exe
        7⤵
        
        PID:4992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52831.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22426.exe
        6⤵
        
        PID:544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52702.exe
        7⤵
        
        PID:872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21246.exe
        7⤵
        
        PID:3192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21236.exe
        7⤵
        
        PID:4832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52831.exe
        7⤵
        
        PID:4496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22918.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63754.exe
        6⤵
        
        PID:3892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40903.exe
        6⤵
        
        PID:4536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19614.exe
        6⤵
        
        PID:5892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13800.exe
        5⤵
        
        PID:888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29049.exe
        6⤵
        
        PID:296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1017.exe
        6⤵
        
        PID:3780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-567.exe
        6⤵
        
        PID:4528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49726.exe
        6⤵
        
        PID:5336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36760.exe
        5⤵
        
        PID:2136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53261.exe
        5⤵
        
        PID:3964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15558.exe
        5⤵
        
        PID:4712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53361.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19451.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19451.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61902.exe
        5⤵
        
        PID:2256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4547.exe
        6⤵
        
        PID:4076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21158.exe
        6⤵
        
        PID:4720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55486.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22918.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63754.exe
        5⤵
        
        PID:3720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40903.exe
        5⤵
        
        PID:4548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63771.exe
        5⤵
        
        PID:5384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34959.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34959.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27430.exe
        5⤵
        
        PID:1856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28004.exe
        6⤵
        
        PID:4384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41895.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38015.exe
        5⤵
        
        PID:3820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12745.exe
        5⤵
        
        PID:4272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9135.exe
        5⤵
        
        PID:5284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63808.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63808.exe
      4⤵
      PID:2500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65280.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65280.exe
      4⤵
      PID:3596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10475.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10475.exe
      4⤵
      PID:3716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48742.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48742.exe
      4⤵
      PID:4356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44391.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44391.exe
      4⤵
      PID:5392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60184.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60184.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53127.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53127.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46962.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30372.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11046.exe
        7⤵
        
        PID:968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54077.exe
        7⤵
        
        PID:3828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12745.exe
        7⤵
        
        PID:4264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61351.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27937.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2275.exe
        6⤵
        
        PID:3812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18610.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48747.exe
        6⤵
        
        PID:4184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48607.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62354.exe
        6⤵
        
        PID:2176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39168.exe
        7⤵
        
        PID:760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52318.exe
        8⤵
        
        PID:1868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5343.exe
        8⤵
        
        PID:3608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12745.exe
        8⤵
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32716.exe
        8⤵
        
        PID:5312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3480.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39307.exe
        7⤵
        
        PID:3868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34755.exe
        7⤵
        
        PID:4132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36686.exe
        7⤵
        
        PID:5012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64419.exe
        6⤵
        
        PID:2524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5399.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18610.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36302.exe
        6⤵
        
        PID:3772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19358.exe
        5⤵
        
        PID:1836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59505.exe
        5⤵
        
        PID:3360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9945.exe
        5⤵
        
        PID:384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36871.exe
        5⤵
        
        PID:4512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14652.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14652.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39308.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50055.exe
        6⤵
        
        PID:2552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43713.exe
        7⤵
        
        PID:3124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45418.exe
        7⤵
        
        PID:3412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37693.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58000.exe
        6⤵
        
        PID:2672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1017.exe
        6⤵
        
        PID:3900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-567.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63748.exe
        6⤵
        
        PID:6092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1217.exe
        5⤵
        
        PID:2560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32171.exe
        6⤵
        
        PID:5000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61979.exe
        6⤵
        
        PID:5432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28237.exe
        5⤵
        
        PID:2540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3535.exe
        5⤵
        
        PID:4080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23967.exe
        5⤵
        
        PID:5064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54192.exe
        5⤵
        
        PID:5504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41154.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41154.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11461.exe
        5⤵
        
        PID:2720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26738.exe
        6⤵
        
        PID:4972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17054.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14502.exe
        5⤵
        
        PID:2952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63207.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49161.exe
        5⤵
        
        PID:5036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21632.exe
      4⤵
      PID:2428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60922.exe
        5⤵
        
        PID:3432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48019.exe
        5⤵
        
        PID:3376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14790.exe
        5⤵
        
        PID:4124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26335.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26335.exe
      4⤵
      PID:3256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58947.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58947.exe
      4⤵
      PID:1704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45577.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45577.exe
      4⤵
      PID:4868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13940.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13940.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13713.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13713.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49349.exe
        5⤵
        
        PID:2588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34368.exe
        6⤵
        
        PID:3092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49472.exe
        6⤵
        
        PID:2744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26767.exe
        6⤵
        
        PID:5080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13855.exe
        6⤵
        
        PID:5556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28237.exe
        5⤵
        
        PID:1188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48129.exe
        5⤵
        
        PID:4912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59282.exe
        5⤵
        
        PID:6072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27309.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27309.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15369.exe
        5⤵
        
        PID:2480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17595.exe
        5⤵
        
        PID:3652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61754.exe
        5⤵
        
        PID:3380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53712.exe
        5⤵
        
        PID:1384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50656.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50656.exe
      4⤵
      PID:3016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40847.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40847.exe
      4⤵
      PID:3272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61573.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61573.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53216.exe
      4⤵
      PID:5248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13448.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13448.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56687.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56687.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14471.exe
        5⤵
        
        PID:3064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57201.exe
        5⤵
        
        PID:3528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12745.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61496.exe
        5⤵
        
        PID:4632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55867.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55867.exe
      4⤵
      PID:2152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21818.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21818.exe
      4⤵
      PID:3656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18610.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18610.exe
      4⤵
      PID:4168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15882.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15882.exe
      4⤵
      PID:5048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2448.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2448.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30287.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30287.exe
      4⤵
      PID:3172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15371.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15371.exe
      4⤵
      PID:4800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24548.exe
      4⤵
      PID:4420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27236.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27236.exe
    3⤵
    PID:2332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32712.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32712.exe
    3⤵
    PID:3300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51772.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51772.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1915.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1915.exe
    3⤵
    PID:5156
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50973.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50973.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55545.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55545.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44959.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44959.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26158.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19080.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3418.exe
        7⤵
        
        PID:2468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37439.exe
        7⤵
        
        PID:3116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12745.exe
        7⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13470.exe
        7⤵
        
        PID:5296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16033.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50983.exe
        6⤵
        
        PID:3248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18610.exe
        6⤵
        
        PID:1496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48747.exe
        6⤵
        
        PID:4196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15550.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52619.exe
        6⤵
        
        PID:2816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37439.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12745.exe
        6⤵
        
        PID:4320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26131.exe
        6⤵
        
        PID:5768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9156.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65016.exe
        5⤵
        
        PID:3340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9945.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32787.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59385.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59385.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22780.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56786.exe
        6⤵
        
        PID:628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3352.exe
        6⤵
        
        PID:3352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57969.exe
        6⤵
        
        PID:4500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42240.exe
        6⤵
        
        PID:5364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3672.exe
        5⤵
        
        PID:3000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31330.exe
        5⤵
        
        PID:3680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18610.exe
        5⤵
        
        PID:3388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52831.exe
        5⤵
        
        PID:4444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59026.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59026.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48042.exe
        5⤵
        
        PID:2740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17595.exe
        5⤵
        
        PID:3672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12745.exe
        5⤵
        
        PID:4288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9135.exe
        5⤵
        
        PID:5276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27165.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27165.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28530.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28530.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42418.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42418.exe
      4⤵
      PID:3148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16796.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16796.exe
      4⤵
      PID:2996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25093.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25093.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45810.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45810.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42733.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49287.exe
        6⤵
        
        PID:2664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40865.exe
        7⤵
        
        PID:1656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44451.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7507.exe
        8⤵
        
        PID:4032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12745.exe
        8⤵
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63241.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44814.exe
        7⤵
        
        PID:2984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46899.exe
        7⤵
        
        PID:3152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18610.exe
        7⤵
        
        PID:3392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52831.exe
        7⤵
        
        PID:684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46464.exe
        6⤵
        
        PID:1624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17651.exe
        6⤵
        
        PID:3480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18610.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24050.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37013.exe
        5⤵
        
        PID:2224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39360.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39258.exe
        6⤵
        
        PID:3088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12571.exe
        6⤵
        
        PID:4644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7515.exe
        6⤵
        
        PID:5180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49841.exe
        5⤵
        
        PID:1312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8140.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9945.exe
        5⤵
        
        PID:3952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53208.exe
        5⤵
        
        PID:4396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48716.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42318.exe
        5⤵
        
        PID:1644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32033.exe
        6⤵
        
        PID:3724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39829.exe
        6⤵
        
        PID:4048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44968.exe
        6⤵
        
        PID:5008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55473.exe
        5⤵
        
        PID:3200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12745.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24548.exe
        5⤵
        
        PID:4164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36188.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36188.exe
      4⤵
      PID:2456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14443.exe
        5⤵
        
        PID:3704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1942.exe
        5⤵
        
        PID:3996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38077.exe
        5⤵
        
        PID:5608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30917.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30917.exe
      4⤵
      PID:3284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9945.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9945.exe
      4⤵
      PID:3932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53208.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53208.exe
      4⤵
      PID:4364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5720.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5720.exe
      4⤵
      PID:5376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59908.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59908.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35416.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35416.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36920.exe
        5⤵
        
        PID:1372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34981.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42278.exe
        5⤵
        
        PID:3004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38608.exe
        5⤵
        
        PID:5600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35913.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35913.exe
      4⤵
      PID:2208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17350.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17350.exe
      4⤵
      PID:3968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18610.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18610.exe
      4⤵
      PID:4148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-470.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-470.exe
      4⤵
      PID:5240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39043.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39043.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40023.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40023.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5399.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5399.exe
      4⤵
      PID:3560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18610.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18610.exe
      4⤵
      PID:3240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36302.exe
      4⤵
      PID:4776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33387.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33387.exe
    3⤵
    PID:2924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29049.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29049.exe
      4⤵
      PID:1740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27250.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27250.exe
      4⤵
      PID:3880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58814.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58814.exe
      4⤵
      PID:4104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21542.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21542.exe
      4⤵
      PID:5628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3583.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3583.exe
    3⤵
    PID:556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38716.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38716.exe
    3⤵
    PID:3884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11093.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11093.exe
    3⤵
    PID:4728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55083.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55083.exe
    3⤵
    PID:4932
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57583.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57583.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20071.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20071.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34518.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34518.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32100.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21898.exe
        6⤵
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55492.exe
        7⤵
        
        PID:4380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12233.exe
        7⤵
        
        PID:5860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56433.exe
        6⤵
        
        PID:3316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12745.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61496.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22452.exe
        5⤵
        
        PID:492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45383.exe
        6⤵
        
        PID:4460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26566.exe
        6⤵
        
        PID:5524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45280.exe
        5⤵
        
        PID:3400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18610.exe
        5⤵
        
        PID:4156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24050.exe
        5⤵
        
        PID:5136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27309.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27309.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29049.exe
        5⤵
        
        PID:2848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27250.exe
        5⤵
        
        PID:3936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49853.exe
        5⤵
        
        PID:4456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34103.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34103.exe
      4⤵
      PID:1112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55254.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55254.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3348.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3348.exe
      4⤵
      PID:5108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5720.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5720.exe
      4⤵
      PID:5448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59385.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59385.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7595.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7595.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60356.exe
        5⤵
        
        PID:2780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54077.exe
        5⤵
        
        PID:3836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12745.exe
        5⤵
        
        PID:4216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61496.exe
        5⤵
        
        PID:4700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44383.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44383.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45123.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45123.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61573.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61573.exe
      4⤵
      PID:4804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36833.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36833.exe
      4⤵
      PID:3452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42114.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42114.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49910.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49910.exe
      4⤵
      PID:840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43335.exe
        5⤵
        
        PID:880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7507.exe
        5⤵
        
        PID:4024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        5⤵
        
        PID:5024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52831.exe
        5⤵
        
        PID:4436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53174.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53174.exe
      4⤵
      PID:664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51175.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51175.exe
      4⤵
      PID:2868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18610.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18610.exe
      4⤵
      PID:4140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37501.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37501.exe
      4⤵
      PID:5516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14699.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14699.exe
    3⤵
    PID:1696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7147.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7147.exe
      4⤵
      PID:3960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51932.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51932.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21884.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21884.exe
      4⤵
      PID:5876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2599.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2599.exe
    3⤵
    PID:3540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58947.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58947.exe
    3⤵
    PID:3776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4736.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4736.exe
    3⤵
    PID:4368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49726.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49726.exe
    3⤵
    PID:5344
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3277.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3277.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46962.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46962.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22780.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18556.exe
        5⤵
        
        PID:2612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40480.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58648.exe
        5⤵
        
        PID:4968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19767.exe
        5⤵
        
        PID:5088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35254.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35254.exe
      4⤵
      PID:1808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5020.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5020.exe
      4⤵
      PID:3224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37813.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37813.exe
      4⤵
      PID:3164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11742.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11742.exe
      4⤵
      PID:5640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12426.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12426.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-470.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-470.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20495.exe
        5⤵
        
        PID:4860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4802.exe
        5⤵
        
        PID:5408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14502.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14502.exe
      4⤵
      PID:2192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63207.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63207.exe
      4⤵
      PID:4060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49161.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49161.exe
      4⤵
      PID:2564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5190.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5190.exe
      4⤵
      PID:5488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9415.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9415.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36693.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36693.exe
      4⤵
      PID:3196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46893.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46893.exe
      4⤵
      PID:5056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36302.exe
      4⤵
      PID:3768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34103.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34103.exe
    3⤵
    PID:2128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51170.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51170.exe
    3⤵
    PID:3208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7432.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7432.exe
    3⤵
    PID:5096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5720.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5720.exe
    3⤵
    PID:5484
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25587.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25587.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32292.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32292.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3418.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3418.exe
      4⤵
      PID:1620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35942.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35942.exe
      4⤵
      PID:3572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40759.exe
      4⤵
      PID:4760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24050.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24050.exe
      4⤵
      PID:5196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40537.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40537.exe
    3⤵
    PID:1900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63235.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63235.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18610.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18610.exe
    3⤵
    PID:4112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15882.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15882.exe
    3⤵
    PID:4108
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6634.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6634.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63672.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63672.exe
    3⤵
    PID:1536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57201.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57201.exe
    3⤵
    PID:3520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12745.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12745.exe
    3⤵
    PID:4296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24548.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24548.exe
    3⤵
    PID:4408
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18131.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18131.exe
  2⤵
  PID:1064
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44011.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44011.exe
  2⤵
  PID:3800
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49146.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49146.exe
  2⤵
  PID:3420
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47607.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47607.exe
  2⤵
  PID:4200
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20856.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20856.exe
  2⤵
  PID:5420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-20071.exe

Filesize
468KB

MD5
b020b9986212b956201c72b434375309

SHA1
b1657d862b289f12d6fb0e497610e3be247a982d

SHA256
77f410026caaf0d33e50274224af4148217a8403230db592a0f3ef1c6175e446

SHA512
c99e5fdcefb9d1b11a81f73142667377948fa5b4b4d3535e8a7932eee12e84e7acb7693b96f71e8c053437c81658a83bba3287d7edd969a57fc5007c7116ed5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3277.exe

Filesize
468KB

MD5
e4ba87488691cb240640e79ced2bde47

SHA1
68c0f412470cbefa02696b1e3793ef3fb0e38f83

SHA256
0d09ca831f2949293d1d260bcb60a593bbfdff69b82e2075be0c1d47525b4c85

SHA512
26d00588b024e6382c6501d3d2fcd0d2b39c78e91925ca6e537ff06746ebcd964cd35aead1cf2ffdce2a103b9c8003b240b387e2c51210df5eacbe565f164f96

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36878.exe

Filesize
468KB

MD5
4c3c674a7d0c99d3c1c49e7793718a59

SHA1
6314ed0006f477e8501f7aef6dd707b500d3b6ad

SHA256
4ec7c9718308187d41b38cc74f9017ed93497fd72de258b0295ef3f6c976d855

SHA512
1b884d0b6e8f4a02d0d800da3437b556982afe63146d4fc42c11bbea295813fc184ee0f9d8d954da2063a679f3667a9ac96ab7eabbc481d6f7e0b214f5ce7933

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40023.exe

Filesize
468KB

MD5
25909bfe708418501e843e80d067d561

SHA1
829f262d06fb3aae921b34dd95f77a77c58966b1

SHA256
612c42523c9320c7014e9b36b2bac6278b8ee03d79d6b12d3adaf269e1c952fe

SHA512
e2f6a908139a49d121200a517ac3847a3dc827397ea4508f84821cadb362fa94eaca096c84c9d099cfb491aebb2e63382c1cc958431ed380041656fb444a0274

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60184.exe

Filesize
468KB

MD5
b4e77db12ba3845a189d33ec63424120

SHA1
cd8b8ec6a20be4af4dc2c6e539c3cb0dd5eb1eb4

SHA256
2db8d24d605243a5116c09dc7e252eb0eecb5375aa055cce26ce740a28081b82

SHA512
ded6f57eeb7968e4395a4e3deb70fff0cb5f9acac66d645336f6d03a2c418f66934204b7a5811a8720b8fc3613a49ccfd4aef12617432ac6c94493e4f063bea9

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-13940.exe

Filesize
468KB

MD5
a648871b1a648db1154831f83fdf7276

SHA1
5b25c4fc98f7d17b5031d059d26f308a12360b7d

SHA256
658ff793d0163110023a859ba9d757b84b5e4a6f850b495697a8a0c6875ba209

SHA512
e3a9df10ea7ee2ce16543c9a8cfe90df9a84cd4f42afa9b63417dfa62e6bec59be7fd09a09d07d7a4f0fef9157dca309ee75e6dab6179c6ad184387b1e919bf0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-17414.exe

Filesize
468KB

MD5
6cda156e187c08df501fa32b29eec47d

SHA1
94d71f639d4b458349a3d76a0318a1b1f45f6ff2

SHA256
c40337dde86bd48f39ba871db86c174bee77262029499c923e3acd2357ea1efd

SHA512
f1f8eb3eb0b3e669187b42edf8ebfa169300a17885c2cd44079ce1a1858121c4e0f6812e3f884f0b689b53026d79d3f6c51f249d60ea12139bd814f4a4de56ee

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-19451.exe

Filesize
468KB

MD5
d93d27c2f2dcf431695c08d876e94b5d

SHA1
895e18374d7552fa8c09d507a57884c84df833e3

SHA256
aa324dd2c33a1fb619c6ae8d15eca8f672775b6a1820e2b4f21d82d461dea49d

SHA512
707ab2cc2a6802051207f0804ed5a18a72c119471fbc5e4cdc926a90a84283a67c34310a684e411626c36508b0f431c075b40424b5fda319e354dfd903226654

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-25093.exe

Filesize
468KB

MD5
9d17bc7681938f92ce981e219a6d7d8b

SHA1
dfb6b95e7bef9903fbb88c9acd86fbf6fab89c1f

SHA256
dc3a4e3fdd6d8ac67f73b410c8b72af17ff29b01284ea43ce86cc82b571b5947

SHA512
5f295d1deda0852ea6d4f98df9fbe5f6667bbabaee17dc92a5bddf27d6cb7fd1889105852196fbb0b3c05c145663a7f0f5ca178e91d3abab4437e8bdc6275c4c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-26957.exe

Filesize
468KB

MD5
6d947412b9db7be1f9f5d6959410676f

SHA1
8181240cc8052e973e65efcc8715dd94be513fb0

SHA256
9f75b19771d2809ef1cb50796b13aa963e7dca0c88903212c35daf40880e7e76

SHA512
b3e60ff782c893dcfd61029aa34fab14ea5f23a70df140726f58c8a2874283ad6011848ff47c0d26032b7e5d49deabb6d3ecf740ecdd9c11ae3ceb21ed44b4db

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-29806.exe

Filesize
468KB

MD5
05c80e7dbf0c124cf16f8e20cd936a50

SHA1
5e3a0327092c96ce99517f8b89f4dcc13c8e47ba

SHA256
5c9d38f9b720eb1bf0c2d58fd6e8775d64b3d29b786367ca52d467afda4f6958

SHA512
6129b74de6c97d88467d2a7fb9c6f16c1b7c3e26e8bca4f81579cafeea2987b5abef8ce61c86b95452d239d864a5a8ab293557ae4f123c8ba6d1df89ed2e523c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-42110.exe

Filesize
468KB

MD5
c4c42ca429e785019a279da65d369fb8

SHA1
a79dd931b47d33e274e6ad54afc9b6dc373b40b6

SHA256
3c466ea63e82158999d32b44cb0a320b1d5267003aa5ba0cd62e1d3dd06e07e5

SHA512
1a4e1b681136e897b3362b5fd7eec16250dd1dac283dd1bae78d20a6044adfffb3395bc9d38112925565ca1d430c6a2f6ce62c3f0386ddb4a12cbf0be1b5c32e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-44959.exe

Filesize
468KB

MD5
c10095ee20766f11acacec3dd4686217

SHA1
6792e322269ea79e51ac427d18fe451506a5bae8

SHA256
33a534fc353ac9317179eef6f4af36e7a9ddcc19e52f6dcabc0fc92d6c321487

SHA512
b517241332ee1d1f490dd48b028779d4a7a3efe86cc13399154c2a312237a7990606f806e87131fbb87f11e5af5e4b293a49a2a1f74cf2a6be69e6c39dc02319

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-46168.exe

Filesize
468KB

MD5
07d56b8a1ddcecaef36a0a43e5b3d135

SHA1
adf0075b5cc37323570c02518acb96ba1cab167c

SHA256
fbf9a1e94c36e9c7ba242fb7380f8ed1f7aba25868e18aabe04cbb48cdffc2fd

SHA512
8c5d617527686df9d1dbebe3b7fd80dace0d24186a2aafbf3e45b24e15b09eb83dd033499a6bdef3fe78207fc1dedbba2573c032f1c80ad0ce787066679aa44c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-48576.exe

Filesize
468KB

MD5
dcf6cc9692127dbd962a83d09a302cb5

SHA1
10c4a1d623e04ed29f839defcb990a875a93b362

SHA256
ab9f4336fa9a52c0002928f57f37d2b36b66939758aead64920be2544e903014

SHA512
d9e7a79eb92a7c01ce79a8a4b377674530a9d24d6072eb6f8b7aa2a6f478de490cb85f3a9eb1e17900f5690f3fc3d333d3c094d667c502ab41688bee84c5b5ea

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-50973.exe

Filesize
468KB

MD5
9897894acf15c79896413075c1606068

SHA1
84664bf1c6836de4607a18781c9c88c8a457df0d

SHA256
132c2cbf4d0e6c5715972e7697a072cc5b4ad6e7a8625154180fa3e93dfae008

SHA512
a2ad0b5d52b122918b02d015c6f936050f66378868f78c8f2461034f5c46be8edfddc7217dd224c1a8902e712986e6f5818ae329f7b21337e2eabeeba63ada43

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-53127.exe

Filesize
468KB

MD5
7c6021d6acbfcffe667962e8e3af3d14

SHA1
fccbd36e57439e0a72c29fc3598f149a5547c5ff

SHA256
95d4330727f8eb8ca67a74da89082f91e971568f412f6238439702dbe288cc04

SHA512
9aa08ca17b0d637832df1d1b3905e1845b340171aacb14e8c6a7d27a9751830d4b37bc291606e726fab6dd7b5d61d66c9e740582c98fcf80b894cb9a5eede47a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-55545.exe

Filesize
468KB

MD5
2c93e1ba3b8f14377521fccb96313b95

SHA1
06119a9619f30348b723d71a83fe368a55226c06

SHA256
f48f6a0c552ea9eca82e71a0af4a3a0b9697c5a0f8954e5763cf13e2344044d0

SHA512
53d1012df2873e7e36400040f49c0e5b4849926bfbfc9f71a23c58c5035d74606c996ae8933aaa0277d5015dafe726ee9a71e21cd9bd69e92a48adf3ee4dad77

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-57583.exe

Filesize
468KB

MD5
bd660da59fce802e5c4cd939a350e3da

SHA1
86f1b0a35179b53952b05867304fb472162ddbcc

SHA256
2bc3a39c6d9830219d45633a8a9505aa28905e0255f8741719ce56ac8c9a9523

SHA512
958d6544ff5311505ced00ac49aed7b77a465556c07166aa96cc7dad4985c390d3f47fe44568a01f49bd7376aa9176b8bf29cfa85f378a7f4e0e565098e91e22

Download Submit
memory/276-368-0x0000000001F80000-0x0000000001FF5000-memory.dmp

Filesize
468KB

Download
memory/276-237-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/936-235-0x00000000026A0000-0x0000000002715000-memory.dmp

Filesize
468KB

Download
memory/936-139-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/936-379-0x00000000026A0000-0x0000000002715000-memory.dmp

Filesize
468KB

Download
memory/936-236-0x00000000026A0000-0x0000000002715000-memory.dmp

Filesize
468KB

Download
memory/936-378-0x00000000026A0000-0x0000000002715000-memory.dmp

Filesize
468KB

Download
memory/1048-262-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1080-294-0x0000000002470000-0x00000000024E5000-memory.dmp

Filesize
468KB

Download
memory/1080-167-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1080-295-0x0000000002470000-0x00000000024E5000-memory.dmp

Filesize
468KB

Download
memory/1084-108-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1084-213-0x0000000002560000-0x00000000025D5000-memory.dmp

Filesize
468KB

Download
memory/1428-264-0x0000000002840000-0x00000000028B5000-memory.dmp

Filesize
468KB

Download
memory/1428-183-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1428-263-0x0000000002840000-0x00000000028B5000-memory.dmp

Filesize
468KB

Download
memory/1432-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1432-320-0x00000000025B0000-0x0000000002625000-memory.dmp

Filesize
468KB

Download
memory/1432-321-0x00000000025B0000-0x0000000002625000-memory.dmp

Filesize
468KB

Download
memory/1432-160-0x00000000025B0000-0x0000000002625000-memory.dmp

Filesize
468KB

Download
memory/1432-364-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1432-168-0x00000000025B0000-0x0000000002625000-memory.dmp

Filesize
468KB

Download
memory/1432-58-0x00000000025B0000-0x0000000002625000-memory.dmp

Filesize
468KB

Download
memory/1432-21-0x00000000025B0000-0x0000000002625000-memory.dmp

Filesize
468KB

Download
memory/1548-259-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1652-260-0x00000000033C0000-0x0000000003435000-memory.dmp

Filesize
468KB

Download
memory/1652-261-0x0000000002890000-0x0000000002905000-memory.dmp

Filesize
468KB

Download
memory/1652-146-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1908-274-0x0000000002890000-0x0000000002905000-memory.dmp

Filesize
468KB

Download
memory/1908-354-0x00000000033C0000-0x0000000003435000-memory.dmp

Filesize
468KB

Download
memory/1908-279-0x0000000002890000-0x0000000002905000-memory.dmp

Filesize
468KB

Download
memory/1908-181-0x00000000033C0000-0x0000000003435000-memory.dmp

Filesize
468KB

Download
memory/1908-358-0x0000000002890000-0x0000000002905000-memory.dmp

Filesize
468KB

Download
memory/1908-6-0x00000000033C0000-0x0000000003435000-memory.dmp

Filesize
468KB

Download
memory/1908-180-0x00000000033C0000-0x0000000003435000-memory.dmp

Filesize
468KB

Download
memory/1908-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1908-12-0x0000000002890000-0x0000000002905000-memory.dmp

Filesize
468KB

Download
memory/1908-343-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1908-76-0x0000000002890000-0x0000000002905000-memory.dmp

Filesize
468KB

Download
memory/1972-390-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2044-366-0x0000000002660000-0x00000000026D5000-memory.dmp

Filesize
468KB

Download
memory/2044-365-0x0000000002660000-0x00000000026D5000-memory.dmp

Filesize
468KB

Download
memory/2044-204-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2056-250-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2072-214-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2072-346-0x0000000002700000-0x0000000002775000-memory.dmp

Filesize
468KB

Download
memory/2072-350-0x0000000002700000-0x0000000002775000-memory.dmp

Filesize
468KB

Download
memory/2120-326-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2148-225-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2148-224-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2148-401-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2148-43-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2156-329-0x00000000007C0000-0x0000000000835000-memory.dmp

Filesize
468KB

Download
memory/2156-136-0x00000000007C0000-0x0000000000835000-memory.dmp

Filesize
468KB

Download
memory/2156-324-0x00000000007C0000-0x0000000000835000-memory.dmp

Filesize
468KB

Download
memory/2156-70-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2216-305-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2220-293-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2340-244-0x0000000001CA0000-0x0000000001D15000-memory.dmp

Filesize
468KB

Download
memory/2340-137-0x0000000001CA0000-0x0000000001D15000-memory.dmp

Filesize
468KB

Download
memory/2340-249-0x0000000001CA0000-0x0000000001D15000-memory.dmp

Filesize
468KB

Download
memory/2340-36-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2340-138-0x0000000001CA0000-0x0000000001D15000-memory.dmp

Filesize
468KB

Download
memory/2356-325-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2396-98-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2396-203-0x00000000025A0000-0x0000000002615000-memory.dmp

Filesize
468KB

Download
memory/2396-391-0x00000000025A0000-0x0000000002615000-memory.dmp

Filesize
468KB

Download
memory/2396-389-0x00000000025A0000-0x0000000002615000-memory.dmp

Filesize
468KB

Download
memory/2396-199-0x00000000025A0000-0x0000000002615000-memory.dmp

Filesize
468KB

Download
memory/2424-298-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2516-226-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2616-323-0x0000000002430000-0x00000000024A5000-memory.dmp

Filesize
468KB

Download
memory/2616-327-0x0000000002430000-0x00000000024A5000-memory.dmp

Filesize
468KB

Download
memory/2616-161-0x0000000002430000-0x00000000024A5000-memory.dmp

Filesize
468KB

Download
memory/2616-84-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2616-159-0x0000000002430000-0x00000000024A5000-memory.dmp

Filesize
468KB

Download
memory/2624-380-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2712-304-0x0000000002960000-0x00000000029D5000-memory.dmp

Filesize
468KB

Download
memory/2712-300-0x0000000002960000-0x00000000029D5000-memory.dmp

Filesize
468KB

Download
memory/2712-140-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2728-142-0x0000000003380000-0x00000000033F5000-memory.dmp

Filesize
468KB

Download
memory/2728-290-0x0000000002640000-0x00000000026B5000-memory.dmp

Filesize
468KB

Download
memory/2728-292-0x0000000002640000-0x00000000026B5000-memory.dmp

Filesize
468KB

Download
memory/2728-141-0x0000000003380000-0x00000000033F5000-memory.dmp

Filesize
468KB

Download
memory/2728-60-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2872-255-0x00000000005C0000-0x0000000000635000-memory.dmp

Filesize
468KB

Download
memory/2872-256-0x00000000005C0000-0x0000000000635000-memory.dmp

Filesize
468KB

Download
memory/2872-95-0x00000000005C0000-0x0000000000635000-memory.dmp

Filesize
468KB

Download
memory/2888-362-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2916-367-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2932-351-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2944-328-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2968-178-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2968-322-0x00000000025F0000-0x0000000002665000-memory.dmp

Filesize
468KB

Download
memory/2968-319-0x00000000025F0000-0x0000000002665000-memory.dmp

Filesize
468KB

Download
memory/3028-400-0x0000000002540000-0x00000000025B5000-memory.dmp

Filesize
468KB

Download