1e21af8c7227b5386587566fc21ae6497701c0420e8b327b01884ebad8845833

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
25-09-2024 20:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1e21af8c7227b5386587566fc21ae6497701c0420e8b327b01884ebad8845833N.exe
Size

468KB
MD5

519bdc9696f2dbe6b9eaff5a9bcdb240
SHA1

bf18f4976240008795f9ffa52d8c9b9448023a12
SHA256

1e21af8c7227b5386587566fc21ae6497701c0420e8b327b01884ebad8845833
SHA512

6bf832581f65d6d12175a7e9fc424ccc5bcd01659da0a01b82d480e8e5de6638375b4a919f1d67c15d50e136383691d18432c08c85ab41467dfe6011f66d8044
SSDEEP

3072:BqobogCdj08U2bYBPz59ff8/5CK3IXpInmHevVn2ck03ukGNeLlV:BqIoh5U2iP19ffP5S8ck6LGNe

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2420	Unicorn-29812.exe
2352	Unicorn-36994.exe
2364	Unicorn-13044.exe
2996	Unicorn-12572.exe
2776	Unicorn-41161.exe
2232	Unicorn-56106.exe
2664	Unicorn-29576.exe
1156	Unicorn-53556.exe
488	Unicorn-50795.exe
1744	Unicorn-39934.exe
2208	Unicorn-34266.exe
1528	Unicorn-39742.exe
780	Unicorn-39477.exe
2060	Unicorn-58116.exe
992	Unicorn-37002.exe
1592	Unicorn-35418.exe
1140	Unicorn-24558.exe
1364	Unicorn-18890.exe
2068	Unicorn-3544.exe
1804	Unicorn-60821.exe
2292	Unicorn-34179.exe
336	Unicorn-48304.exe
908	Unicorn-48569.exe
612	Unicorn-61376.exe
584	Unicorn-15705.exe
1708	Unicorn-40301.exe
1604	Unicorn-15705.exe
2464	Unicorn-35362.exe
2008	Unicorn-26565.exe
2076	Unicorn-61589.exe
2752	Unicorn-58060.exe
2864	Unicorn-55367.exe
1932	Unicorn-28624.exe
2644	Unicorn-51859.exe
2948	Unicorn-48330.exe
2672	Unicorn-21032.exe
1512	Unicorn-57889.exe
3052	Unicorn-28844.exe
2920	Unicorn-41361.exe
1612	Unicorn-13903.exe
2784	Unicorn-39799.exe
1260	Unicorn-25409.exe
1160	Unicorn-5543.exe
2152	Unicorn-47967.exe
2080	Unicorn-29799.exe
2116	Unicorn-47967.exe
320	Unicorn-23825.exe
2992	Unicorn-43691.exe
3008	Unicorn-37561.exe
1340	Unicorn-43390.exe
888	Unicorn-23524.exe
2056	Unicorn-20566.exe
1720	Unicorn-10617.exe
772	Unicorn-16748.exe
1580	Unicorn-32122.exe
2808	Unicorn-4303.exe
2820	Unicorn-4203.exe
2768	Unicorn-57396.exe
2652	Unicorn-15740.exe
1540	Unicorn-15740.exe
2924	Unicorn-36160.exe
2212	Unicorn-49804.exe
2908	Unicorn-18977.exe
592	Unicorn-55834.exe

Loads dropped DLL 64 IoCs

pid	Process
1196	1e21af8c7227b5386587566fc21ae6497701c0420e8b327b01884ebad8845833N.exe
1196	1e21af8c7227b5386587566fc21ae6497701c0420e8b327b01884ebad8845833N.exe
2420	Unicorn-29812.exe
2420	Unicorn-29812.exe
1196	1e21af8c7227b5386587566fc21ae6497701c0420e8b327b01884ebad8845833N.exe
1196	1e21af8c7227b5386587566fc21ae6497701c0420e8b327b01884ebad8845833N.exe
2352	Unicorn-36994.exe
2352	Unicorn-36994.exe
2420	Unicorn-29812.exe
2420	Unicorn-29812.exe
2364	Unicorn-13044.exe
2364	Unicorn-13044.exe
1196	1e21af8c7227b5386587566fc21ae6497701c0420e8b327b01884ebad8845833N.exe
1196	1e21af8c7227b5386587566fc21ae6497701c0420e8b327b01884ebad8845833N.exe
2996	Unicorn-12572.exe
2996	Unicorn-12572.exe
2352	Unicorn-36994.exe
2352	Unicorn-36994.exe
2776	Unicorn-41161.exe
2776	Unicorn-41161.exe
2364	Unicorn-13044.exe
2364	Unicorn-13044.exe
1196	1e21af8c7227b5386587566fc21ae6497701c0420e8b327b01884ebad8845833N.exe
2664	Unicorn-29576.exe
1196	1e21af8c7227b5386587566fc21ae6497701c0420e8b327b01884ebad8845833N.exe
2664	Unicorn-29576.exe
2420	Unicorn-29812.exe
2420	Unicorn-29812.exe
1156	Unicorn-53556.exe
1156	Unicorn-53556.exe
2996	Unicorn-12572.exe
2996	Unicorn-12572.exe
488	Unicorn-50795.exe
488	Unicorn-50795.exe
2232	Unicorn-56106.exe
2232	Unicorn-56106.exe
2352	Unicorn-36994.exe
2352	Unicorn-36994.exe
2060	Unicorn-58116.exe
2060	Unicorn-58116.exe
2420	Unicorn-29812.exe
1528	Unicorn-39742.exe
1528	Unicorn-39742.exe
2420	Unicorn-29812.exe
2208	Unicorn-34266.exe
2208	Unicorn-34266.exe
2364	Unicorn-13044.exe
780	Unicorn-39477.exe
1744	Unicorn-39934.exe
2776	Unicorn-41161.exe
1744	Unicorn-39934.exe
2776	Unicorn-41161.exe
1196	1e21af8c7227b5386587566fc21ae6497701c0420e8b327b01884ebad8845833N.exe
1196	1e21af8c7227b5386587566fc21ae6497701c0420e8b327b01884ebad8845833N.exe
780	Unicorn-39477.exe
2364	Unicorn-13044.exe
2664	Unicorn-29576.exe
2664	Unicorn-29576.exe
992	Unicorn-37002.exe
992	Unicorn-37002.exe
1156	Unicorn-53556.exe
1156	Unicorn-53556.exe
1592	Unicorn-35418.exe
1592	Unicorn-35418.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42564.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59795.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52608.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36072.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35290.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12233.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2980.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1345.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52608.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61273.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53556.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34179.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42564.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59795.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4303.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48652.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62595.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33593.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8003.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4203.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36160.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61947.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18906.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18168.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29424.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54575.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56300.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44293.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59795.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34264.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36681.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8958.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43259.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32853.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46513.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45873.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59041.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39519.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35418.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53369.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54822.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62802.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6497.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32853.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61376.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7313.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14121.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59795.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35290.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24927.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2923.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42048.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54957.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40436.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37499.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45584.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2923.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39742.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3697.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45767.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62595.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55408.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48569.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1196	1e21af8c7227b5386587566fc21ae6497701c0420e8b327b01884ebad8845833N.exe
2420	Unicorn-29812.exe
2352	Unicorn-36994.exe
2364	Unicorn-13044.exe
2996	Unicorn-12572.exe
2776	Unicorn-41161.exe
2664	Unicorn-29576.exe
2232	Unicorn-56106.exe
1156	Unicorn-53556.exe
488	Unicorn-50795.exe
1744	Unicorn-39934.exe
2208	Unicorn-34266.exe
1528	Unicorn-39742.exe
780	Unicorn-39477.exe
2060	Unicorn-58116.exe
992	Unicorn-37002.exe
1592	Unicorn-35418.exe
1140	Unicorn-24558.exe
1364	Unicorn-18890.exe
2068	Unicorn-3544.exe
1804	Unicorn-60821.exe
2292	Unicorn-34179.exe
336	Unicorn-48304.exe
1708	Unicorn-40301.exe
2008	Unicorn-26565.exe
584	Unicorn-15705.exe
612	Unicorn-61376.exe
908	Unicorn-48569.exe
1604	Unicorn-15705.exe
2464	Unicorn-35362.exe
2752	Unicorn-58060.exe
2076	Unicorn-61589.exe
2864	Unicorn-55367.exe
2644	Unicorn-51859.exe
1932	Unicorn-28624.exe
2948	Unicorn-48330.exe
2672	Unicorn-21032.exe
1512	Unicorn-57889.exe
3052	Unicorn-28844.exe
2920	Unicorn-41361.exe
1612	Unicorn-13903.exe
2784	Unicorn-39799.exe
3008	Unicorn-37561.exe
2992	Unicorn-43691.exe
1340	Unicorn-43390.exe
320	Unicorn-23825.exe
888	Unicorn-23524.exe
1260	Unicorn-25409.exe
2080	Unicorn-29799.exe
2152	Unicorn-47967.exe
2116	Unicorn-47967.exe
1160	Unicorn-5543.exe
2056	Unicorn-20566.exe
1720	Unicorn-10617.exe
772	Unicorn-16748.exe
1580	Unicorn-32122.exe
2808	Unicorn-4303.exe
2820	Unicorn-4203.exe
2768	Unicorn-57396.exe
1540	Unicorn-15740.exe
2924	Unicorn-36160.exe
2652	Unicorn-15740.exe
2212	Unicorn-49804.exe
1600	Unicorn-61864.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 2420	1196	1e21af8c7227b5386587566fc21ae6497701c0420e8b327b01884ebad8845833N.exe	30
PID 1196 wrote to memory of 2420	1196	1e21af8c7227b5386587566fc21ae6497701c0420e8b327b01884ebad8845833N.exe	30
PID 1196 wrote to memory of 2420	1196	1e21af8c7227b5386587566fc21ae6497701c0420e8b327b01884ebad8845833N.exe	30
PID 1196 wrote to memory of 2420	1196	1e21af8c7227b5386587566fc21ae6497701c0420e8b327b01884ebad8845833N.exe	30
PID 2420 wrote to memory of 2352	2420	Unicorn-29812.exe	31
PID 2420 wrote to memory of 2352	2420	Unicorn-29812.exe	31
PID 2420 wrote to memory of 2352	2420	Unicorn-29812.exe	31
PID 2420 wrote to memory of 2352	2420	Unicorn-29812.exe	31
PID 1196 wrote to memory of 2364	1196	1e21af8c7227b5386587566fc21ae6497701c0420e8b327b01884ebad8845833N.exe	32
PID 1196 wrote to memory of 2364	1196	1e21af8c7227b5386587566fc21ae6497701c0420e8b327b01884ebad8845833N.exe	32
PID 1196 wrote to memory of 2364	1196	1e21af8c7227b5386587566fc21ae6497701c0420e8b327b01884ebad8845833N.exe	32
PID 1196 wrote to memory of 2364	1196	1e21af8c7227b5386587566fc21ae6497701c0420e8b327b01884ebad8845833N.exe	32
PID 2352 wrote to memory of 2996	2352	Unicorn-36994.exe	33
PID 2352 wrote to memory of 2996	2352	Unicorn-36994.exe	33
PID 2352 wrote to memory of 2996	2352	Unicorn-36994.exe	33
PID 2352 wrote to memory of 2996	2352	Unicorn-36994.exe	33
PID 2420 wrote to memory of 2232	2420	Unicorn-29812.exe	34
PID 2420 wrote to memory of 2232	2420	Unicorn-29812.exe	34
PID 2420 wrote to memory of 2232	2420	Unicorn-29812.exe	34
PID 2420 wrote to memory of 2232	2420	Unicorn-29812.exe	34
PID 2364 wrote to memory of 2776	2364	Unicorn-13044.exe	35
PID 2364 wrote to memory of 2776	2364	Unicorn-13044.exe	35
PID 2364 wrote to memory of 2776	2364	Unicorn-13044.exe	35
PID 2364 wrote to memory of 2776	2364	Unicorn-13044.exe	35
PID 1196 wrote to memory of 2664	1196	1e21af8c7227b5386587566fc21ae6497701c0420e8b327b01884ebad8845833N.exe	36
PID 1196 wrote to memory of 2664	1196	1e21af8c7227b5386587566fc21ae6497701c0420e8b327b01884ebad8845833N.exe	36
PID 1196 wrote to memory of 2664	1196	1e21af8c7227b5386587566fc21ae6497701c0420e8b327b01884ebad8845833N.exe	36
PID 1196 wrote to memory of 2664	1196	1e21af8c7227b5386587566fc21ae6497701c0420e8b327b01884ebad8845833N.exe	36
PID 2996 wrote to memory of 1156	2996	Unicorn-12572.exe	38
PID 2996 wrote to memory of 1156	2996	Unicorn-12572.exe	38
PID 2996 wrote to memory of 1156	2996	Unicorn-12572.exe	38
PID 2996 wrote to memory of 1156	2996	Unicorn-12572.exe	38
PID 2352 wrote to memory of 488	2352	Unicorn-36994.exe	39
PID 2352 wrote to memory of 488	2352	Unicorn-36994.exe	39
PID 2352 wrote to memory of 488	2352	Unicorn-36994.exe	39
PID 2352 wrote to memory of 488	2352	Unicorn-36994.exe	39
PID 2776 wrote to memory of 1744	2776	Unicorn-41161.exe	40
PID 2776 wrote to memory of 1744	2776	Unicorn-41161.exe	40
PID 2776 wrote to memory of 1744	2776	Unicorn-41161.exe	40
PID 2776 wrote to memory of 1744	2776	Unicorn-41161.exe	40
PID 2364 wrote to memory of 2208	2364	Unicorn-13044.exe	41
PID 2364 wrote to memory of 2208	2364	Unicorn-13044.exe	41
PID 2364 wrote to memory of 2208	2364	Unicorn-13044.exe	41
PID 2364 wrote to memory of 2208	2364	Unicorn-13044.exe	41
PID 1196 wrote to memory of 780	1196	1e21af8c7227b5386587566fc21ae6497701c0420e8b327b01884ebad8845833N.exe	42
PID 1196 wrote to memory of 780	1196	1e21af8c7227b5386587566fc21ae6497701c0420e8b327b01884ebad8845833N.exe	42
PID 1196 wrote to memory of 780	1196	1e21af8c7227b5386587566fc21ae6497701c0420e8b327b01884ebad8845833N.exe	42
PID 1196 wrote to memory of 780	1196	1e21af8c7227b5386587566fc21ae6497701c0420e8b327b01884ebad8845833N.exe	42
PID 2664 wrote to memory of 1528	2664	Unicorn-29576.exe	43
PID 2664 wrote to memory of 1528	2664	Unicorn-29576.exe	43
PID 2664 wrote to memory of 1528	2664	Unicorn-29576.exe	43
PID 2664 wrote to memory of 1528	2664	Unicorn-29576.exe	43
PID 2420 wrote to memory of 2060	2420	Unicorn-29812.exe	44
PID 2420 wrote to memory of 2060	2420	Unicorn-29812.exe	44
PID 2420 wrote to memory of 2060	2420	Unicorn-29812.exe	44
PID 2420 wrote to memory of 2060	2420	Unicorn-29812.exe	44
PID 1156 wrote to memory of 992	1156	Unicorn-53556.exe	45
PID 1156 wrote to memory of 992	1156	Unicorn-53556.exe	45
PID 1156 wrote to memory of 992	1156	Unicorn-53556.exe	45
PID 1156 wrote to memory of 992	1156	Unicorn-53556.exe	45
PID 2996 wrote to memory of 1592	2996	Unicorn-12572.exe	46
PID 2996 wrote to memory of 1592	2996	Unicorn-12572.exe	46
PID 2996 wrote to memory of 1592	2996	Unicorn-12572.exe	46
PID 2996 wrote to memory of 1592	2996	Unicorn-12572.exe	46

C:\Users\Admin\AppData\Local\Temp\1e21af8c7227b5386587566fc21ae6497701c0420e8b327b01884ebad8845833N.exe
"C:\Users\Admin\AppData\Local\Temp\1e21af8c7227b5386587566fc21ae6497701c0420e8b327b01884ebad8845833N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29812.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29812.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36994.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36994.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12572.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12572.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53556.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37002.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61589.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10254.exe
        8⤵
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9337.exe
        9⤵
        
        PID:3404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50017.exe
        9⤵
        
        PID:4716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55408.exe
        9⤵
        
        PID:5308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54008.exe
        9⤵
        
        PID:6344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41854.exe
        8⤵
        
        PID:3828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10241.exe
        8⤵
        
        PID:5020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36072.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45873.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15740.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57225.exe
        8⤵
        
        PID:2360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8543.exe
        9⤵
        
        PID:3496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48860.exe
        9⤵
        
        PID:4264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33593.exe
        9⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36681.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22253.exe
        8⤵
        
        PID:3880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46482.exe
        8⤵
        
        PID:5100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61273.exe
        8⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32322.exe
        8⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33388.exe
        7⤵
        
        PID:2764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23920.exe
        8⤵
        
        PID:3292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55408.exe
        8⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40988.exe
        8⤵
        
        PID:4996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41854.exe
        7⤵
        
        PID:3864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8871.exe
        7⤵
        
        PID:4180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36072.exe
        7⤵
        
        PID:5376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11062.exe
        7⤵
        
        PID:6272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58060.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4303.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39519.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13094.exe
        9⤵
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48860.exe
        9⤵
        
        PID:4240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29424.exe
        9⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63930.exe
        9⤵
        
        PID:6928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22253.exe
        8⤵
        
        PID:3888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-105.exe
        8⤵
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52608.exe
        8⤵
        
        PID:5396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59534.exe
        8⤵
        
        PID:6316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6908.exe
        7⤵
        
        PID:1508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25109.exe
        8⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35989.exe
        7⤵
        
        PID:3784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15368.exe
        7⤵
        
        PID:4268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36072.exe
        7⤵
        
        PID:3972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32853.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4203.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7313.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42564.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62595.exe
        7⤵
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24927.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59041.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35637.exe
        6⤵
        
        PID:1556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53500.exe
        6⤵
        
        PID:2880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43259.exe
        6⤵
        
        PID:4596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27155.exe
        6⤵
        
        PID:5860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34264.exe
        6⤵
        
        PID:6592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35418.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55367.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57396.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64490.exe
        8⤵
        
        PID:672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42564.exe
        8⤵
        
        PID:3988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62595.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51626.exe
        8⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53369.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61947.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59795.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26425.exe
        7⤵
        
        PID:4296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36160.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35995.exe
        7⤵
        
        PID:1788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53282.exe
        7⤵
        
        PID:3364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53138.exe
        7⤵
        
        PID:5156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42048.exe
        7⤵
        
        PID:6096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10145.exe
        6⤵
        
        PID:264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50287.exe
        7⤵
        
        PID:3960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4433.exe
        7⤵
        
        PID:4284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55408.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40988.exe
        7⤵
        
        PID:6108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7235.exe
        6⤵
        
        PID:4020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15368.exe
        6⤵
        
        PID:4260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36072.exe
        6⤵
        
        PID:5244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63579.exe
        6⤵
        
        PID:5872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28624.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60302.exe
        6⤵
        
        PID:1760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58979.exe
        7⤵
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19317.exe
        8⤵
        
        PID:4456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48860.exe
        8⤵
        
        PID:4876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43999.exe
        8⤵
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46929.exe
        7⤵
        
        PID:3148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6689.exe
        7⤵
        
        PID:3108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2923.exe
        7⤵
        
        PID:4812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20402.exe
        7⤵
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38729.exe
        7⤵
        
        PID:6728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27.exe
        6⤵
        
        PID:2320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11444.exe
        7⤵
        
        PID:4748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9004.exe
        7⤵
        
        PID:5540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55210.exe
        6⤵
        
        PID:3328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6031.exe
        6⤵
        
        PID:4128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59795.exe
        6⤵
        
        PID:4332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25458.exe
        6⤵
        
        PID:5932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50491.exe
        6⤵
        
        PID:6468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13358.exe
        5⤵
        
        PID:1040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42119.exe
        6⤵
        
        PID:3896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56208.exe
        6⤵
        
        PID:4544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26624.exe
        6⤵
        
        PID:5756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50573.exe
        5⤵
        
        PID:588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52699.exe
        5⤵
        
        PID:3280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60325.exe
        5⤵
        
        PID:4148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36350.exe
        5⤵
        
        PID:5964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50795.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50795.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24558.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15740.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19653.exe
        7⤵
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35989.exe
        7⤵
        
        PID:3808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15368.exe
        7⤵
        
        PID:4320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36072.exe
        7⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11062.exe
        7⤵
        
        PID:6264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13762.exe
        6⤵
        
        PID:296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8574.exe
        7⤵
        
        PID:532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42564.exe
        7⤵
        
        PID:4052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62595.exe
        7⤵
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35290.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39612.exe
        6⤵
        
        PID:3048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53500.exe
        6⤵
        
        PID:3816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53138.exe
        6⤵
        
        PID:5172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11322.exe
        6⤵
        
        PID:5016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48330.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49804.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59721.exe
        7⤵
        
        PID:1268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42564.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62595.exe
        7⤵
        
        PID:944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35290.exe
        7⤵
        
        PID:5852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3675.exe
        6⤵
        
        PID:2400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56300.exe
        6⤵
        
        PID:4060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2923.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8392.exe
        6⤵
        
        PID:5900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10569.exe
        6⤵
        
        PID:6368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18977.exe
        5⤵
        Executes dropped EXE
        
        PID:2908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59721.exe
        6⤵
        
        PID:3016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42564.exe
        6⤵
        
        PID:4028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62595.exe
        6⤵
        
        PID:4344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35290.exe
        6⤵
        
        PID:5644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55948.exe
        5⤵
        
        PID:3028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53500.exe
        5⤵
        
        PID:3924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53138.exe
        5⤵
        
        PID:5180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42048.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3544.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3544.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57889.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61864.exe
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64490.exe
        7⤵
        
        PID:1920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42564.exe
        7⤵
        
        PID:4012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62595.exe
        7⤵
        
        PID:4688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35290.exe
        7⤵
        
        PID:5636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62414.exe
        6⤵
        
        PID:2704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56300.exe
        6⤵
        
        PID:4064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52608.exe
        6⤵
        
        PID:5040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46513.exe
        6⤵
        
        PID:5676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1734.exe
        5⤵
        
        PID:1092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8958.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42564.exe
        6⤵
        
        PID:4040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61273.exe
        6⤵
        
        PID:5212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32322.exe
        6⤵
        
        PID:5652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49891.exe
        5⤵
        
        PID:1056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62165.exe
        5⤵
        
        PID:3056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36072.exe
        5⤵
        
        PID:1352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32853.exe
        5⤵
        
        PID:5668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28844.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28844.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55834.exe
        5⤵
        Executes dropped EXE
        
        PID:592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        6⤵
        
        PID:848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37416.exe
        6⤵
        
        PID:3316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2923.exe
        6⤵
        
        PID:4380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26624.exe
        6⤵
        
        PID:5804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8003.exe
        6⤵
        
        PID:6864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54822.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8248.exe
        5⤵
        
        PID:4516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53138.exe
        5⤵
        
        PID:5348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42048.exe
        5⤵
        
        PID:6128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40682.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40682.exe
      4⤵
      PID:1768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17703.exe
        5⤵
        
        PID:2844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37416.exe
        5⤵
        
        PID:3256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2923.exe
        5⤵
        
        PID:3024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26624.exe
        5⤵
        
        PID:5764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8003.exe
        5⤵
        
        PID:6856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28609.exe
      4⤵
      PID:1724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32281.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32281.exe
      4⤵
      PID:3220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33459.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33459.exe
      4⤵
      PID:4116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4489.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4489.exe
      4⤵
      PID:5876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5393.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5393.exe
      4⤵
      PID:6760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56106.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56106.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18890.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18890.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51859.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21600.exe
        6⤵
        
        PID:420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57365.exe
        7⤵
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58299.exe
        7⤵
        
        PID:3368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62595.exe
        7⤵
        
        PID:4928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51626.exe
        7⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55265.exe
        7⤵
        
        PID:6884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36155.exe
        6⤵
        
        PID:448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56300.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2923.exe
        6⤵
        
        PID:4820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20402.exe
        6⤵
        
        PID:6056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38729.exe
        6⤵
        
        PID:6748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18454.exe
        5⤵
        
        PID:1824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22253.exe
        6⤵
        
        PID:3856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11671.exe
        6⤵
        
        PID:4168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61273.exe
        6⤵
        
        PID:5324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10532.exe
        6⤵
        
        PID:6256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23632.exe
        5⤵
        
        PID:1696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22285.exe
        5⤵
        
        PID:3388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59795.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26425.exe
        5⤵
        
        PID:5512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21032.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21032.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21600.exe
        5⤵
        
        PID:1700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13618.exe
        6⤵
        
        PID:2132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37416.exe
        6⤵
        
        PID:3228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52608.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15787.exe
        6⤵
        
        PID:4164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30129.exe
        5⤵
        
        PID:2756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61947.exe
        5⤵
        
        PID:3436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20900.exe
        5⤵
        
        PID:1960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26425.exe
        5⤵
        
        PID:5492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60037.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60037.exe
      4⤵
      PID:1624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33655.exe
        5⤵
        
        PID:2280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56082.exe
        5⤵
        
        PID:3764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2923.exe
        5⤵
        
        PID:2532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26624.exe
        5⤵
        
        PID:5740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38729.exe
        5⤵
        
        PID:6612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49229.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49229.exe
      4⤵
      PID:2596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36964.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36964.exe
      4⤵
      PID:1820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60325.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60325.exe
      4⤵
      PID:4152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5624.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5624.exe
      4⤵
      PID:5780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58116.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58116.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60821.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60821.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39799.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16385.exe
        6⤵
        
        PID:2576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9680.exe
        7⤵
        
        PID:5940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12233.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56492.exe
        6⤵
        
        PID:3296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47543.exe
        6⤵
        
        PID:4540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40403.exe
        6⤵
        
        PID:5948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31137.exe
        5⤵
        
        PID:2180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20198.exe
        6⤵
        
        PID:3340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21842.exe
        6⤵
        
        PID:4672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61273.exe
        6⤵
        
        PID:5300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10532.exe
        6⤵
        
        PID:6248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35989.exe
        5⤵
        
        PID:3800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18906.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52608.exe
        5⤵
        
        PID:5432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59534.exe
        5⤵
        
        PID:6280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5543.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5543.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55040.exe
        5⤵
        
        PID:2616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48320.exe
        6⤵
        
        PID:3200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27764.exe
        6⤵
        
        PID:3284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62595.exe
        6⤵
        
        PID:4668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35290.exe
        6⤵
        
        PID:5612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29331.exe
        5⤵
        
        PID:2972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6497.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2923.exe
        5⤵
        
        PID:4448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26624.exe
        5⤵
        
        PID:5748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8003.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16045.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16045.exe
      4⤵
      PID:2876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35570.exe
        5⤵
        
        PID:3244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48860.exe
        5⤵
        
        PID:4232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29424.exe
        5⤵
        
        PID:5828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48932.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48932.exe
      4⤵
      PID:2868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3697.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3697.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43259.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43259.exe
      4⤵
      PID:4616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43491.exe
      4⤵
      PID:5548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34264.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34264.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48304.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48304.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25409.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25409.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63374.exe
        5⤵
        
        PID:2628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65044.exe
        5⤵
        
        PID:3156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55206.exe
        5⤵
        
        PID:5524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63291.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63291.exe
      4⤵
      PID:1264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56300.exe
      4⤵
      PID:4048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52608.exe
      4⤵
      PID:5052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59534.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59534.exe
      4⤵
      PID:6208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29799.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29799.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16743.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16743.exe
      4⤵
      PID:1936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27193.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27193.exe
      4⤵
      PID:2932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-83.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-83.exe
      4⤵
      PID:3176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2923.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2923.exe
      4⤵
      PID:4416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26624.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26624.exe
      4⤵
      PID:5820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47384.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47384.exe
    3⤵
    PID:3036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54030.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54030.exe
    3⤵
    PID:3520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38794.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38794.exe
    3⤵
    PID:4208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16625.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16625.exe
    3⤵
    PID:5564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33129.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33129.exe
    3⤵
    PID:6916
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13044.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13044.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41161.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41161.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39934.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39934.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15705.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47967.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17708.exe
        7⤵
        
        PID:1928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36260.exe
        8⤵
        
        PID:2684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11048.exe
        8⤵
        
        PID:4524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2923.exe
        8⤵
        
        PID:4468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57351.exe
        8⤵
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38729.exe
        8⤵
        
        PID:6672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37499.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45694.exe
        7⤵
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59795.exe
        7⤵
        
        PID:4776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44899.exe
        7⤵
        
        PID:5916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30514.exe
        6⤵
        
        PID:2892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10022.exe
        7⤵
        
        PID:3120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57718.exe
        7⤵
        
        PID:4384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55408.exe
        7⤵
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6177.exe
        7⤵
        
        PID:5716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51235.exe
        6⤵
        
        PID:2384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12362.exe
        6⤵
        
        PID:3312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59795.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26425.exe
        6⤵
        
        PID:5476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55795.exe
        6⤵
        
        PID:6840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23825.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38367.exe
        6⤵
        
        PID:1124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2705.exe
        7⤵
        
        PID:3184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55408.exe
        7⤵
        
        PID:5292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6177.exe
        7⤵
        
        PID:5660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15180.exe
        6⤵
        
        PID:3484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35361.exe
        6⤵
        
        PID:4304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52608.exe
        6⤵
        
        PID:5196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15787.exe
        6⤵
        
        PID:5580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10254.exe
        5⤵
        
        PID:1284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35269.exe
        6⤵
        
        PID:4360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55408.exe
        6⤵
        
        PID:5268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6177.exe
        6⤵
        
        PID:5892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41854.exe
        5⤵
        
        PID:3848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43682.exe
        5⤵
        
        PID:5108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36072.exe
        5⤵
        
        PID:5440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11062.exe
        5⤵
        
        PID:6288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61376.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43390.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2980.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42119.exe
        7⤵
        
        PID:3872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63473.exe
        7⤵
        
        PID:4188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55408.exe
        7⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19197.exe
        7⤵
        
        PID:6224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49067.exe
        6⤵
        
        PID:2524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45584.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2923.exe
        6⤵
        
        PID:2084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26624.exe
        6⤵
        
        PID:5796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48652.exe
        5⤵
        
        PID:2792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43546.exe
        6⤵
        
        PID:3428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48860.exe
        6⤵
        
        PID:4216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29424.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62802.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51449.exe
        5⤵
        
        PID:3492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59795.exe
        5⤵
        
        PID:4644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25458.exe
        5⤵
        
        PID:5988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10617.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10617.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32394.exe
        5⤵
        
        PID:2428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42564.exe
        5⤵
        
        PID:3980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62595.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35290.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64225.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64225.exe
      4⤵
      PID:2608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53500.exe
      4⤵
      PID:3912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53138.exe
      4⤵
      PID:5164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59152.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59152.exe
      4⤵
      PID:6172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34266.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34266.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34179.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34179.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41361.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2980.exe
        6⤵
        
        PID:2912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2221.exe
        7⤵
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52608.exe
        7⤵
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63618.exe
        7⤵
        
        PID:6156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49067.exe
        6⤵
        
        PID:2468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45584.exe
        6⤵
        
        PID:3396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2923.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20642.exe
        6⤵
        
        PID:7028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41283.exe
        5⤵
        
        PID:1644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53500.exe
        5⤵
        
        PID:3824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43259.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57881.exe
        5⤵
        
        PID:6008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34264.exe
        5⤵
        
        PID:6664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13903.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13903.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16385.exe
        5⤵
        
        PID:1524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36260.exe
        6⤵
        
        PID:1828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42346.exe
        6⤵
        
        PID:3384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62595.exe
        6⤵
        
        PID:4872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-479.exe
        6⤵
        
        PID:6016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24370.exe
        5⤵
        
        PID:3248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8334.exe
        5⤵
        
        PID:3968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2923.exe
        5⤵
        
        PID:4420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8392.exe
        5⤵
        
        PID:1712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37212.exe
        5⤵
        
        PID:6404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10062.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10062.exe
      4⤵
      PID:1992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6919.exe
        5⤵
        
        PID:4932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41672.exe
        5⤵
        
        PID:5452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13332.exe
        5⤵
        
        PID:6232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41854.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41854.exe
      4⤵
      PID:3792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10241.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10241.exe
      4⤵
      PID:5008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36072.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36072.exe
      4⤵
      PID:5228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32853.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32853.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40301.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40301.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43691.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43691.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2980.exe
        5⤵
        
        PID:2340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8107.exe
        6⤵
        
        PID:1836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53172.exe
        6⤵
        
        PID:4004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18168.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61273.exe
        6⤵
        
        PID:5356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45343.exe
        6⤵
        
        PID:6336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38018.exe
        5⤵
        
        PID:1864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33933.exe
        5⤵
        
        PID:3320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-105.exe
        5⤵
        
        PID:4580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52608.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46513.exe
        5⤵
        
        PID:5700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48652.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48652.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20308.exe
        5⤵
        
        PID:3356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51968.exe
        5⤵
        
        PID:4136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61273.exe
        5⤵
        
        PID:5220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14616.exe
        5⤵
        
        PID:6148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62802.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62802.exe
      4⤵
      PID:2648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51449.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51449.exe
      4⤵
      PID:3472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59795.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59795.exe
      4⤵
      PID:4852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65320.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65320.exe
      4⤵
      PID:5568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20566.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20566.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21682.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21682.exe
      4⤵
      PID:2344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61947.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61947.exe
      4⤵
      PID:3468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36072.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36072.exe
      4⤵
      PID:5412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11062.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11062.exe
      4⤵
      PID:6304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4823.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4823.exe
    3⤵
    PID:2636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45767.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45767.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55408.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55408.exe
      4⤵
      PID:5284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6177.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6177.exe
      4⤵
      PID:5736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16653.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16653.exe
    3⤵
    PID:3836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10771.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10771.exe
    3⤵
    PID:5032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31607.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31607.exe
    3⤵
    PID:5424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49733.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49733.exe
    3⤵
    PID:6216
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29576.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29576.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39742.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39742.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48569.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48569.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34214.exe
        5⤵
        
        PID:1620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17786.exe
        6⤵
        
        PID:1632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44293.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62595.exe
        6⤵
        
        PID:932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4563.exe
        6⤵
        
        PID:5908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9434.exe
        5⤵
        
        PID:2052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1096.exe
        5⤵
        
        PID:3216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59795.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10089.exe
        5⤵
        
        PID:5704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23524.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23524.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14199.exe
        5⤵
        
        PID:1996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57365.exe
        6⤵
        
        PID:988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39829.exe
        6⤵
        
        PID:4432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2923.exe
        6⤵
        
        PID:4492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57351.exe
        6⤵
        
        PID:5952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37499.exe
        5⤵
        
        PID:1280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45694.exe
        5⤵
        
        PID:4408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36072.exe
        5⤵
        
        PID:5132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32853.exe
        5⤵
        
        PID:5588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36658.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36658.exe
      4⤵
      PID:2860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36748.exe
        5⤵
        
        PID:3112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48860.exe
        5⤵
        
        PID:4248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33593.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24429.exe
        5⤵
        
        PID:6328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14121.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14121.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20493.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20493.exe
      4⤵
      PID:4392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14679.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14679.exe
      4⤵
      PID:5556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26565.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26565.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47967.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47967.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28445.exe
        5⤵
        
        PID:1988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33166.exe
        5⤵
        
        PID:2204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21211.exe
        6⤵
        
        PID:2120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42564.exe
        6⤵
        
        PID:3996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61273.exe
        6⤵
        
        PID:5140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63049.exe
        6⤵
        
        PID:4968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17794.exe
        5⤵
        
        PID:900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62165.exe
        5⤵
        
        PID:3452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59795.exe
        5⤵
        
        PID:4804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40815.exe
        5⤵
        
        PID:6036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35418.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35418.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62165.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62165.exe
      4⤵
      PID:2460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59795.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59795.exe
      4⤵
      PID:4796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25458.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25458.exe
      4⤵
      PID:6028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54575.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54575.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37561.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37561.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21455.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21455.exe
      4⤵
      PID:840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64241.exe
        5⤵
        
        PID:4620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48860.exe
        5⤵
        
        PID:4196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29424.exe
        5⤵
        
        PID:5836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3950.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3950.exe
      4⤵
      PID:3100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53670.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53670.exe
      4⤵
      PID:4756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47543.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47543.exe
      4⤵
      PID:4512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10089.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10089.exe
      4⤵
      PID:5680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29153.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29153.exe
      4⤵
      PID:6568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1345.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1345.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58455.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58455.exe
      4⤵
      PID:3928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33134.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33134.exe
      4⤵
      PID:4532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61273.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61273.exe
      4⤵
      PID:4984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15192.exe
      4⤵
      PID:6188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-495.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-495.exe
    3⤵
    PID:3132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52891.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52891.exe
    3⤵
    PID:3140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60325.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60325.exe
    3⤵
    PID:4156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64939.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64939.exe
    3⤵
    PID:5448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28929.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28929.exe
    3⤵
    PID:6832
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39477.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39477.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15705.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15705.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40436.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44864.exe
        5⤵
        
        PID:2560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42756.exe
        5⤵
        
        PID:3272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39357.exe
        5⤵
        
        PID:4452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61273.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63049.exe
        5⤵
        
        PID:2888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31141.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31141.exe
      4⤵
      PID:3004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35715.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35715.exe
      4⤵
      PID:3416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6214.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6214.exe
      4⤵
      PID:4652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36072.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36072.exe
      4⤵
      PID:4108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32853.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32853.exe
      4⤵
      PID:6136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47950.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47950.exe
    3⤵
    PID:2556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62819.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62819.exe
      4⤵
      PID:1316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37416.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37416.exe
      4⤵
      PID:3092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52608.exe
      4⤵
      PID:5204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46513.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46513.exe
      4⤵
      PID:5656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15299.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15299.exe
    3⤵
    PID:1672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57968.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57968.exe
    3⤵
    PID:3232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43259.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43259.exe
    3⤵
    PID:4604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27155.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27155.exe
    3⤵
    PID:5772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34264.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34264.exe
    3⤵
    PID:6628
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35362.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35362.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16748.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16748.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61070.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61070.exe
      4⤵
      PID:2604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        5⤵
        
        PID:1484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51309.exe
        5⤵
        
        PID:3116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62595.exe
        5⤵
        
        PID:4896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24927.exe
        5⤵
        
        PID:6044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54957.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4443.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4443.exe
      4⤵
      PID:2700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16419.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16419.exe
      4⤵
      PID:3380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2923.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2923.exe
      4⤵
      PID:2536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61934.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61934.exe
      4⤵
      PID:5664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48652.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48652.exe
    3⤵
    PID:324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14464.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14464.exe
      4⤵
      PID:3160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48860.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48860.exe
      4⤵
      PID:4224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29424.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29424.exe
      4⤵
      PID:5812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62802.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62802.exe
    3⤵
    PID:884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51449.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51449.exe
    3⤵
    PID:3952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59795.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59795.exe
    3⤵
    PID:4780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25458.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25458.exe
    3⤵
    PID:5944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15681.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15681.exe
    3⤵
    PID:6412
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32122.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32122.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55040.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55040.exe
    3⤵
    PID:2632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42119.exe
      4⤵
      PID:3904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59777.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59777.exe
      4⤵
      PID:4576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61273.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61273.exe
      4⤵
      PID:5404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10532.exe
      4⤵
      PID:6240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29331.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29331.exe
    3⤵
    PID:3044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45694.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45694.exe
    3⤵
    PID:4424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36072.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36072.exe
    3⤵
    PID:5188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63579.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63579.exe
    3⤵
    PID:5896
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60117.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60117.exe
  2⤵
  PID:2856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36260.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36260.exe
    3⤵
    PID:2324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35435.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35435.exe
    3⤵
    PID:4900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52608.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52608.exe
    3⤵
    PID:5332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46513.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46513.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5868
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12359.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12359.exe
  2⤵
  PID:2200
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28892.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28892.exe
  2⤵
  PID:3208
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37659.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37659.exe
  2⤵
  PID:4316
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42290.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42290.exe
  2⤵
  PID:5884
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52730.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52730.exe
  2⤵
  PID:6848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-12572.exe

Filesize
468KB

MD5
8717ebb30bc8ee4cd0fec012d8fd5933

SHA1
229906609a0d97b896e99a08eb22fc38a4352c41

SHA256
092bbbdec6ae1b2942fd5c1140ba02e44490561ae85d3487aaf84adffe4cd17e

SHA512
6ad3baf966f4da27871503afb13c1f8435573f1a45239795332cc3a7b676a20b437c794efa6033a2eea61a6e0cff32a34d30501d3b718a3acc3fdbc83ea67139

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13044.exe

Filesize
468KB

MD5
840ea7f0f258b2c22254e2bcabae5255

SHA1
7b459b949f88059b26938b7ad530db692b824d2b

SHA256
726817276ce4ebb6622919c474abf3791614f692e9cd043ba5d37cdc8220ef00

SHA512
69a23d23096efb92d1a43621603ed7504689d12ebb2e1cf3efb817d55bf2ff1512b0e724ca15c419de8fc47ff2c8758870badecc8c714a023fadc619c75ccc8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29576.exe

Filesize
468KB

MD5
658695a4dc18a54f8970bbc569c1ce78

SHA1
61e805221bae257804eede92a86080878137db92

SHA256
e437d1ac08d2538a8dba2b43d7a3dc096c00d242f69abbee23f8063c22fd1786

SHA512
6139ceba88641f40a405cda789e2743c55e685d44d3d86213b00cafd09859d40ee90ac000293aba9a6f2dd55687a63928f6c6e9bc1e3dd9cab29a3af1531748e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39934.exe

Filesize
468KB

MD5
c7c9e60c1ddcfb7838b7ebb9791e99bb

SHA1
bd7fcd4645fc9fcf4169e0b188450c3896628fa2

SHA256
47fee65ecff5fec64846f26b8b2929e9e4a03aec1176ee84b627be5f6cb3c65f

SHA512
950bacaacc285150c4ed384a945c8067749de821d65fc7a3d4191cf7c573bef38584b02ad932f82f63b389d7622b36cf9803c53ee89aea6e639b3e270ad6d534

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41161.exe

Filesize
468KB

MD5
1eb8f37bdf4e9ee28102e05b91cf0193

SHA1
8296aaaf605715d245d97ecf5d5506314c452b29

SHA256
31064e0e3350cd6e6df18f0e251a78059d12da203f763ec954bb3dfef9a2ba2a

SHA512
759e41f89f4b3c3f3780df6c33b7eb1706dc95f03c306ce39222996dc7c2fd76213770f2139e7f65915f1cbc830718ad6e1bfadce6202d564777ab30c5f67053

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50795.exe

Filesize
468KB

MD5
7a3ca070ebfa2ad8394dcc292565e09d

SHA1
b5eafb55cd1d4641fc5ca9879f37991b1a916f91

SHA256
20ef3d1377138f41c7c30ab52a6d54efc34f22e8e67ac24f157245848f75f62a

SHA512
5518fc6fa5c2aef07122f834faebb006f6eaed6871da327a59a3fc2928f6d9669965281b24d3d00ff9e6e6274de15c364d1a2bdec43bb7f755c48ab0d350025e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53556.exe

Filesize
468KB

MD5
e92f5984789b06bade24d526af7bf90a

SHA1
f3347c56eb03f182e2f851a1a7913dc974654e53

SHA256
1242ce2a81cb3419506e0ed88974098856acb4a402dec666d1fd6d653dbc06ef

SHA512
12e80d481edc63b9b15814c0411243fb7142a3f86ac2fb4743c202b423f2416758750b0fec3f2f7ba60b3ac85e3aa47817cefc4bee829a95afc8355be072369e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-18890.exe

Filesize
468KB

MD5
6dad173a21905e1a47721f954571ae98

SHA1
1c6925effaf9ac48670b5b5f5c6792ac10b79aa0

SHA256
61492421f71fca5115a90ec34c496dc0ef1335ab475a7cf2c9c3bd9f499ef05a

SHA512
b3f1c742d9c2257e532f2aaba11b2ea47e2dfd2f49d62eeda38927d063811743301725c62c1d32681db75b0d2e6ad23728bd67e7064e811fd4826e4d3394dd43

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-24558.exe

Filesize
468KB

MD5
063e9007ff492693d33ac15d1e9c8f06

SHA1
e958d6d372486214d94e5ba7c7799bf9f96dd7e8

SHA256
0ddf78ae9819eb8264d74c4c30b9f234157299ad4d0ce6863192d77fb0a7a3eb

SHA512
1d93c4c7d7aee75339e5d6313efd4986019949732bc34382dbf09a836f3d77f4e5e45c51d704dd14aa8665655ac47d8a59283cde3d4b79d4d186448a984d8b51

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-29812.exe

Filesize
468KB

MD5
8df8ed95e6390df842f5595413b78315

SHA1
645cce4eabdac48ce0555bc8b23788ce72cd7615

SHA256
d14bea68e1c7d727b139c4080b3606e3e22f5359e7179601dcc28d7c5e35b8c7

SHA512
dde22e13ccdb6e2333b43c99a19926e2571515ad0501d1ad2c8b6de980641746a30190adc9e43c0ef788a02c39f280249abb75dc5c443dcd81b95e8fd5f0f4a1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-34266.exe

Filesize
468KB

MD5
a9006111b271efad967a2fb483a89b87

SHA1
810ae1da5097cda1c8a2fa70f01ceb7e7aed28bd

SHA256
5f5492671419be3d00fc5fb0d5acef15ff20384264b621715437f03d2ae447f4

SHA512
cdec8dcd2d3b20f76d8e261a298f316c818082ecd2d136c3fe4622474b0e50f6e4a47415c2a068e07eff6ca8c8227607c61b6e6154e57337e6d9ae4875196765

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-35418.exe

Filesize
468KB

MD5
0d9b4a4fedbacca91a7e2d55ece0eb1d

SHA1
08092cff09162ec9d90697a204fb8b084252c309

SHA256
e0c6c14d0ae60857e2af84827724969d56d6608362e6305eec7751dfd12f5f76

SHA512
6743c11effbb118668448cd381b07d2b78c8f5a905a2cb99d07bd66837a4873302bbc70694744e87865b9ca6d83e7eb16e818265304a144e0159c08816ff83e3

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-36994.exe

Filesize
468KB

MD5
bdfa02d3dc3b360e7600d23dc628b8f1

SHA1
fb07f6dfdf2b6d7d626db4534daeba0aae5ba58f

SHA256
3266565c9ff2bb50b0f29938e9b24e64adf42475ab28922c234fec5ac8e2d2bd

SHA512
517990de4a78ba691e03dd121168cf6637b6a4c63725331eb86fd7f98213859479847f2d23bb95469043ab47f4b907b5482836810b59f6148e73785412832fbe

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-37002.exe

Filesize
468KB

MD5
43ead4774912a4d7ce01053aa2dd5f0b

SHA1
96a03ecbe5026b6bb69fdeff8c300e82270dd9c9

SHA256
0af6982206c6a4d6b5b8580067294339a7f6d8ff446c47b32c52d02f5527ac40

SHA512
d522d9bedf5b4ea2bee3c5d9c2f62c62370cebc3a862ed6b948caf786905f69f5bae533caa873cf6e6aa512901bd63f568ba8a1a9bdcc73827319b7a883197bf

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-39477.exe

Filesize
468KB

MD5
ae4ca1e802463958b84fdbc45909c6df

SHA1
83f563e32dc8de42dbd4cb894c45e3e83d14fd1a

SHA256
6252a95d50ce772df74666c61bf33f9f282613648a5f62da4d42992723e9368a

SHA512
7b8ac8a70af75ad25697cfcc80d76d89dbe3981dc78abfe33dd647a921a4fb5f01533c1dc4548b7c1f468fa4149f2a2f58d36d8e34f66fe19e6e4bd6b54d9dd2

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-39742.exe

Filesize
468KB

MD5
00cdf14c9fedbb5b016f75fe54e77796

SHA1
431f85b8cb216ff57a178b1825de08388f592d29

SHA256
4c6049d45f525c02c2a08aaccb7f9e5c87386ddc021433c04d3e20613918ef23

SHA512
033cc9400d00e1006c374ae893289a37724dac8b974e8cffbe3ba179f604f76d1e928d4aea92e23a5608f1bf8f653c528740c7dabbfa28333b54192ad483f416

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-56106.exe

Filesize
468KB

MD5
eae38fd643b7e4d2a56be9e0f19baed9

SHA1
8d56e0a2f6c65faed687e3c3f9ea603590de3f00

SHA256
55e406cffdd1744cf10c358f4ebf4d1ec3b13a249d8cd038f8fcfbd9d63440b3

SHA512
8d6bc4bca811e64e18fe0d11c48b4d87a9e3c02c11e38b6cac43cc938e79dc5e13478c0ab486b7f41faf38ac1b8939d56f07e644ffc7fd62430ad0ca66d94745

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-58116.exe

Filesize
468KB

MD5
67fc569b93ae2c66a416048421a4f65d

SHA1
f8ce35c024343b29e56ad528ba8a47751d2dd23c

SHA256
7ff58577d19bed013c87795574ae5a01d27a9a31fea2de352fdbf829649bc38a

SHA512
f2ce7fab6217250cb5eefae79dfaee59a433910e52abf625e2ddb51520f1d23f8c4bf91dc593f70b0b990ef05a7fc5644d3768a22cd146e90c0373b1bf81c046

Download Submit
memory/336-454-0x0000000002070000-0x00000000020E5000-memory.dmp

Filesize
468KB

Download
memory/488-114-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/488-211-0x00000000028B0000-0x0000000002925000-memory.dmp

Filesize
468KB

Download
memory/488-428-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/488-212-0x00000000028B0000-0x0000000002925000-memory.dmp

Filesize
468KB

Download
memory/780-274-0x0000000002490000-0x0000000002505000-memory.dmp

Filesize
468KB

Download
memory/780-157-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/992-321-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/992-188-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1140-213-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1156-95-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1156-187-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1156-335-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1156-179-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1156-427-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1156-329-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1196-341-0x00000000026C0000-0x0000000002735000-memory.dmp

Filesize
468KB

Download
memory/1196-290-0x00000000026C0000-0x0000000002735000-memory.dmp

Filesize
468KB

Download
memory/1196-156-0x00000000026C0000-0x0000000002735000-memory.dmp

Filesize
468KB

Download
memory/1196-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1196-32-0x00000000026C0000-0x0000000002735000-memory.dmp

Filesize
468KB

Download
memory/1196-146-0x00000000026C0000-0x0000000002735000-memory.dmp

Filesize
468KB

Download
memory/1196-12-0x00000000026C0000-0x0000000002735000-memory.dmp

Filesize
468KB

Download
memory/1196-325-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1196-11-0x00000000026C0000-0x0000000002735000-memory.dmp

Filesize
468KB

Download
memory/1512-391-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1528-249-0x0000000002850000-0x00000000028C5000-memory.dmp

Filesize
468KB

Download
memory/1528-254-0x0000000002850000-0x00000000028C5000-memory.dmp

Filesize
468KB

Download
memory/1528-154-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1592-342-0x00000000024A0000-0x0000000002515000-memory.dmp

Filesize
468KB

Download
memory/1592-198-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1592-346-0x00000000024A0000-0x0000000002515000-memory.dmp

Filesize
468KB

Download
memory/1612-422-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1744-116-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1744-284-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1744-276-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1804-450-0x00000000025E0000-0x0000000002655000-memory.dmp

Filesize
468KB

Download
memory/1804-429-0x00000000025E0000-0x0000000002655000-memory.dmp

Filesize
468KB

Download
memory/1804-244-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1932-356-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2008-304-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2060-243-0x00000000025C0000-0x0000000002635000-memory.dmp

Filesize
468KB

Download
memory/2060-453-0x00000000025C0000-0x0000000002635000-memory.dmp

Filesize
468KB

Download
memory/2060-239-0x00000000025C0000-0x0000000002635000-memory.dmp

Filesize
468KB

Download
memory/2060-452-0x00000000025C0000-0x0000000002635000-memory.dmp

Filesize
468KB

Download
memory/2068-234-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2076-326-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2208-421-0x00000000025F0000-0x0000000002665000-memory.dmp

Filesize
468KB

Download
memory/2208-420-0x00000000025F0000-0x0000000002665000-memory.dmp

Filesize
468KB

Download
memory/2208-260-0x00000000025F0000-0x0000000002665000-memory.dmp

Filesize
468KB

Download
memory/2208-261-0x00000000025F0000-0x0000000002665000-memory.dmp

Filesize
468KB

Download
memory/2208-130-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2232-397-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2232-216-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2232-381-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2292-265-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2352-48-0x0000000000490000-0x0000000000505000-memory.dmp

Filesize
468KB

Download
memory/2352-233-0x0000000000490000-0x0000000000505000-memory.dmp

Filesize
468KB

Download
memory/2352-229-0x0000000000490000-0x0000000000505000-memory.dmp

Filesize
468KB

Download
memory/2352-357-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2364-129-0x00000000023F0000-0x0000000002465000-memory.dmp

Filesize
468KB

Download
memory/2364-273-0x00000000023F0000-0x0000000002465000-memory.dmp

Filesize
468KB

Download
memory/2364-296-0x00000000023F0000-0x0000000002465000-memory.dmp

Filesize
468KB

Download
memory/2364-358-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2420-337-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2420-161-0x0000000002630000-0x00000000026A5000-memory.dmp

Filesize
468KB

Download
memory/2420-55-0x0000000002630000-0x00000000026A5000-memory.dmp

Filesize
468KB

Download
memory/2420-167-0x0000000002630000-0x00000000026A5000-memory.dmp

Filesize
468KB

Download
memory/2420-247-0x0000000002630000-0x00000000026A5000-memory.dmp

Filesize
468KB

Download
memory/2420-26-0x0000000002630000-0x00000000026A5000-memory.dmp

Filesize
468KB

Download
memory/2420-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2464-299-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2644-365-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2664-303-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2664-155-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2664-412-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2664-81-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2664-298-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2664-153-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2672-380-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2752-336-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2776-400-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2776-70-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2776-277-0x00000000026C0000-0x0000000002735000-memory.dmp

Filesize
468KB

Download
memory/2776-286-0x00000000026C0000-0x0000000002735000-memory.dmp

Filesize
468KB

Download
memory/2784-451-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2864-347-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2920-411-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2948-375-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2996-49-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2996-426-0x0000000002930000-0x00000000029A5000-memory.dmp

Filesize
468KB

Download
memory/2996-369-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2996-197-0x0000000003460000-0x00000000034D5000-memory.dmp

Filesize
468KB

Download
memory/2996-425-0x0000000003460000-0x00000000034D5000-memory.dmp

Filesize
468KB

Download
memory/2996-201-0x0000000002930000-0x00000000029A5000-memory.dmp

Filesize
468KB

Download
memory/3052-401-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download