618cc26d80102abbf416408a16c5234cf9c242000d9275280b25c2b8ae63342e

Analysis

max time kernel
150s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28/09/2024, 22:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

618cc26d80102abbf416408a16c5234cf9c242000d9275280b25c2b8ae63342e.exe
Size

468KB
MD5

fcdebcffc5e6f59b203e8e90724ad7c8
SHA1

5e52f2bc71cc06e011ffeb3825c0068448b63754
SHA256

618cc26d80102abbf416408a16c5234cf9c242000d9275280b25c2b8ae63342e
SHA512

f361ceef9b850ca398ac3418dfe49f08293cc95b48bd7a2e2d871b81307aa90bee5901e82467a45a7a172d98cd909e1811fcd66e441a96b3799de9405582972e
SSDEEP

3072:auGhogfxjg8U2bYZPUG8qf8/7C3jyIgZPwfI+V8PmxK+92rMt5Mo:auwogNU2aPL8qfQV33mx98rMt

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2828	Unicorn-56115.exe
2860	Unicorn-39634.exe
2868	Unicorn-11600.exe
2824	Unicorn-33194.exe
2752	Unicorn-51376.exe
2680	Unicorn-57506.exe
2648	Unicorn-37640.exe
1276	Unicorn-29001.exe
2292	Unicorn-967.exe
2972	Unicorn-43967.exe
2528	Unicorn-531.exe
1148	Unicorn-3410.exe
2832	Unicorn-9540.exe
1128	Unicorn-62249.exe
1972	Unicorn-55212.exe
2268	Unicorn-54356.exe
1796	Unicorn-65025.exe
956	Unicorn-3593.exe
1724	Unicorn-41534.exe
1052	Unicorn-42296.exe
1452	Unicorn-57625.exe
1544	Unicorn-7869.exe
636	Unicorn-1647.exe
2816	Unicorn-33005.exe
2392	Unicorn-47319.exe
2080	Unicorn-39136.exe
2988	Unicorn-61502.exe
2160	Unicorn-61237.exe
2840	Unicorn-15984.exe
2748	Unicorn-50381.exe
2892	Unicorn-22115.exe
2280	Unicorn-62078.exe
2656	Unicorn-34729.exe
2424	Unicorn-10246.exe
548	Unicorn-6062.exe
2100	Unicorn-12192.exe
2104	Unicorn-4024.exe
2552	Unicorn-44095.exe
1960	Unicorn-29659.exe
1956	Unicorn-49525.exe
1756	Unicorn-56302.exe
2352	Unicorn-2846.exe
812	Unicorn-42487.exe
2320	Unicorn-62353.exe
1136	Unicorn-21020.exe
2608	Unicorn-35694.exe
2028	Unicorn-39421.exe
2532	Unicorn-14989.exe
1532	Unicorn-36156.exe
964	Unicorn-12851.exe
1552	Unicorn-10719.exe
2016	Unicorn-38124.exe
1064	Unicorn-24096.exe
1188	Unicorn-53261.exe
2772	Unicorn-7589.exe
2788	Unicorn-7589.exe
2088	Unicorn-7589.exe
2952	Unicorn-32648.exe
2688	Unicorn-38216.exe
1356	Unicorn-44346.exe
2640	Unicorn-10203.exe
1824	Unicorn-23110.exe
960	Unicorn-49006.exe
2060	Unicorn-20226.exe

Loads dropped DLL 64 IoCs

pid	Process
2056	618cc26d80102abbf416408a16c5234cf9c242000d9275280b25c2b8ae63342e.exe
2056	618cc26d80102abbf416408a16c5234cf9c242000d9275280b25c2b8ae63342e.exe
2828	Unicorn-56115.exe
2056	618cc26d80102abbf416408a16c5234cf9c242000d9275280b25c2b8ae63342e.exe
2056	618cc26d80102abbf416408a16c5234cf9c242000d9275280b25c2b8ae63342e.exe
2828	Unicorn-56115.exe
2860	Unicorn-39634.exe
2860	Unicorn-39634.exe
2868	Unicorn-11600.exe
2056	618cc26d80102abbf416408a16c5234cf9c242000d9275280b25c2b8ae63342e.exe
2828	Unicorn-56115.exe
2056	618cc26d80102abbf416408a16c5234cf9c242000d9275280b25c2b8ae63342e.exe
2828	Unicorn-56115.exe
2868	Unicorn-11600.exe
2824	Unicorn-33194.exe
2824	Unicorn-33194.exe
2860	Unicorn-39634.exe
2860	Unicorn-39634.exe
2752	Unicorn-51376.exe
2752	Unicorn-51376.exe
2056	618cc26d80102abbf416408a16c5234cf9c242000d9275280b25c2b8ae63342e.exe
2056	618cc26d80102abbf416408a16c5234cf9c242000d9275280b25c2b8ae63342e.exe
2828	Unicorn-56115.exe
2828	Unicorn-56115.exe
2648	Unicorn-37640.exe
2648	Unicorn-37640.exe
2680	Unicorn-57506.exe
2868	Unicorn-11600.exe
2868	Unicorn-11600.exe
2680	Unicorn-57506.exe
1276	Unicorn-29001.exe
1276	Unicorn-29001.exe
2824	Unicorn-33194.exe
2824	Unicorn-33194.exe
2528	Unicorn-531.exe
2528	Unicorn-531.exe
2972	Unicorn-43967.exe
2056	618cc26d80102abbf416408a16c5234cf9c242000d9275280b25c2b8ae63342e.exe
2972	Unicorn-43967.exe
2056	618cc26d80102abbf416408a16c5234cf9c242000d9275280b25c2b8ae63342e.exe
2752	Unicorn-51376.exe
2752	Unicorn-51376.exe
1128	Unicorn-62249.exe
1128	Unicorn-62249.exe
1972	Unicorn-55212.exe
1972	Unicorn-55212.exe
2868	Unicorn-11600.exe
2868	Unicorn-11600.exe
2680	Unicorn-57506.exe
2680	Unicorn-57506.exe
1148	Unicorn-3410.exe
1148	Unicorn-3410.exe
2828	Unicorn-56115.exe
2292	Unicorn-967.exe
2828	Unicorn-56115.exe
2292	Unicorn-967.exe
1276	Unicorn-29001.exe
1276	Unicorn-29001.exe
2860	Unicorn-39634.exe
2860	Unicorn-39634.exe
2268	Unicorn-54356.exe
2268	Unicorn-54356.exe
2832	Unicorn-9540.exe
2832	Unicorn-9540.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19906.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64089.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16791.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35745.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64727.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59331.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54686.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59363.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27295.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32648.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56079.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14702.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35745.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11241.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52838.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17446.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14653.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65427.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49466.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45055.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23878.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10719.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3056.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35745.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25833.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2306.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58533.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10203.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3056.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52838.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38546.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51167.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61042.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14840.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7519.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27766.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14955.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48910.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52838.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27807.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12851.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38124.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1066.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30480.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65412.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29563.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4759.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49121.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50256.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58533.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60243.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55470.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56388.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50826.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45563.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14745.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13689.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45177.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13414.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-967.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7589.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23446.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19502.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51167.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2056	618cc26d80102abbf416408a16c5234cf9c242000d9275280b25c2b8ae63342e.exe
2828	Unicorn-56115.exe
2860	Unicorn-39634.exe
2868	Unicorn-11600.exe
2824	Unicorn-33194.exe
2752	Unicorn-51376.exe
2680	Unicorn-57506.exe
2648	Unicorn-37640.exe
1276	Unicorn-29001.exe
2292	Unicorn-967.exe
2972	Unicorn-43967.exe
2528	Unicorn-531.exe
1128	Unicorn-62249.exe
1148	Unicorn-3410.exe
1972	Unicorn-55212.exe
2832	Unicorn-9540.exe
2268	Unicorn-54356.exe
1796	Unicorn-65025.exe
956	Unicorn-3593.exe
1724	Unicorn-41534.exe
1052	Unicorn-42296.exe
1452	Unicorn-57625.exe
1544	Unicorn-7869.exe
636	Unicorn-1647.exe
2816	Unicorn-33005.exe
2392	Unicorn-47319.exe
2080	Unicorn-39136.exe
2988	Unicorn-61502.exe
2160	Unicorn-61237.exe
2840	Unicorn-15984.exe
2656	Unicorn-34729.exe
2748	Unicorn-50381.exe
2280	Unicorn-62078.exe
2424	Unicorn-10246.exe
2892	Unicorn-22115.exe
548	Unicorn-6062.exe
2100	Unicorn-12192.exe
2552	Unicorn-44095.exe
2104	Unicorn-4024.exe
1956	Unicorn-49525.exe
1960	Unicorn-29659.exe
1756	Unicorn-56302.exe
2352	Unicorn-2846.exe
2320	Unicorn-62353.exe
812	Unicorn-42487.exe
1136	Unicorn-21020.exe
2028	Unicorn-39421.exe
2608	Unicorn-35694.exe
1532	Unicorn-36156.exe
2532	Unicorn-14989.exe
964	Unicorn-12851.exe
1552	Unicorn-10719.exe
2016	Unicorn-38124.exe
1064	Unicorn-24096.exe
2788	Unicorn-7589.exe
2088	Unicorn-7589.exe
2772	Unicorn-7589.exe
1188	Unicorn-53261.exe
2688	Unicorn-38216.exe
2952	Unicorn-32648.exe
1356	Unicorn-44346.exe
1824	Unicorn-23110.exe
2640	Unicorn-10203.exe
960	Unicorn-49006.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 2828	2056	618cc26d80102abbf416408a16c5234cf9c242000d9275280b25c2b8ae63342e.exe	29
PID 2056 wrote to memory of 2828	2056	618cc26d80102abbf416408a16c5234cf9c242000d9275280b25c2b8ae63342e.exe	29
PID 2056 wrote to memory of 2828	2056	618cc26d80102abbf416408a16c5234cf9c242000d9275280b25c2b8ae63342e.exe	29
PID 2056 wrote to memory of 2828	2056	618cc26d80102abbf416408a16c5234cf9c242000d9275280b25c2b8ae63342e.exe	29
PID 2056 wrote to memory of 2868	2056	618cc26d80102abbf416408a16c5234cf9c242000d9275280b25c2b8ae63342e.exe	31
PID 2056 wrote to memory of 2868	2056	618cc26d80102abbf416408a16c5234cf9c242000d9275280b25c2b8ae63342e.exe	31
PID 2056 wrote to memory of 2868	2056	618cc26d80102abbf416408a16c5234cf9c242000d9275280b25c2b8ae63342e.exe	31
PID 2056 wrote to memory of 2868	2056	618cc26d80102abbf416408a16c5234cf9c242000d9275280b25c2b8ae63342e.exe	31
PID 2828 wrote to memory of 2860	2828	Unicorn-56115.exe	30
PID 2828 wrote to memory of 2860	2828	Unicorn-56115.exe	30
PID 2828 wrote to memory of 2860	2828	Unicorn-56115.exe	30
PID 2828 wrote to memory of 2860	2828	Unicorn-56115.exe	30
PID 2860 wrote to memory of 2824	2860	Unicorn-39634.exe	32
PID 2860 wrote to memory of 2824	2860	Unicorn-39634.exe	32
PID 2860 wrote to memory of 2824	2860	Unicorn-39634.exe	32
PID 2860 wrote to memory of 2824	2860	Unicorn-39634.exe	32
PID 2056 wrote to memory of 2752	2056	618cc26d80102abbf416408a16c5234cf9c242000d9275280b25c2b8ae63342e.exe	34
PID 2056 wrote to memory of 2752	2056	618cc26d80102abbf416408a16c5234cf9c242000d9275280b25c2b8ae63342e.exe	34
PID 2056 wrote to memory of 2752	2056	618cc26d80102abbf416408a16c5234cf9c242000d9275280b25c2b8ae63342e.exe	34
PID 2056 wrote to memory of 2752	2056	618cc26d80102abbf416408a16c5234cf9c242000d9275280b25c2b8ae63342e.exe	34
PID 2828 wrote to memory of 2648	2828	Unicorn-56115.exe	35
PID 2828 wrote to memory of 2648	2828	Unicorn-56115.exe	35
PID 2828 wrote to memory of 2648	2828	Unicorn-56115.exe	35
PID 2828 wrote to memory of 2648	2828	Unicorn-56115.exe	35
PID 2868 wrote to memory of 2680	2868	Unicorn-11600.exe	33
PID 2868 wrote to memory of 2680	2868	Unicorn-11600.exe	33
PID 2868 wrote to memory of 2680	2868	Unicorn-11600.exe	33
PID 2868 wrote to memory of 2680	2868	Unicorn-11600.exe	33
PID 2824 wrote to memory of 1276	2824	Unicorn-33194.exe	36
PID 2824 wrote to memory of 1276	2824	Unicorn-33194.exe	36
PID 2824 wrote to memory of 1276	2824	Unicorn-33194.exe	36
PID 2824 wrote to memory of 1276	2824	Unicorn-33194.exe	36
PID 2860 wrote to memory of 2292	2860	Unicorn-39634.exe	37
PID 2860 wrote to memory of 2292	2860	Unicorn-39634.exe	37
PID 2860 wrote to memory of 2292	2860	Unicorn-39634.exe	37
PID 2860 wrote to memory of 2292	2860	Unicorn-39634.exe	37
PID 2752 wrote to memory of 2972	2752	Unicorn-51376.exe	38
PID 2752 wrote to memory of 2972	2752	Unicorn-51376.exe	38
PID 2752 wrote to memory of 2972	2752	Unicorn-51376.exe	38
PID 2752 wrote to memory of 2972	2752	Unicorn-51376.exe	38
PID 2056 wrote to memory of 2528	2056	618cc26d80102abbf416408a16c5234cf9c242000d9275280b25c2b8ae63342e.exe	39
PID 2056 wrote to memory of 2528	2056	618cc26d80102abbf416408a16c5234cf9c242000d9275280b25c2b8ae63342e.exe	39
PID 2056 wrote to memory of 2528	2056	618cc26d80102abbf416408a16c5234cf9c242000d9275280b25c2b8ae63342e.exe	39
PID 2056 wrote to memory of 2528	2056	618cc26d80102abbf416408a16c5234cf9c242000d9275280b25c2b8ae63342e.exe	39
PID 2828 wrote to memory of 1148	2828	Unicorn-56115.exe	40
PID 2828 wrote to memory of 1148	2828	Unicorn-56115.exe	40
PID 2828 wrote to memory of 1148	2828	Unicorn-56115.exe	40
PID 2828 wrote to memory of 1148	2828	Unicorn-56115.exe	40
PID 2648 wrote to memory of 2832	2648	Unicorn-37640.exe	41
PID 2648 wrote to memory of 2832	2648	Unicorn-37640.exe	41
PID 2648 wrote to memory of 2832	2648	Unicorn-37640.exe	41
PID 2648 wrote to memory of 2832	2648	Unicorn-37640.exe	41
PID 2868 wrote to memory of 1972	2868	Unicorn-11600.exe	43
PID 2868 wrote to memory of 1972	2868	Unicorn-11600.exe	43
PID 2868 wrote to memory of 1972	2868	Unicorn-11600.exe	43
PID 2868 wrote to memory of 1972	2868	Unicorn-11600.exe	43
PID 2680 wrote to memory of 1128	2680	Unicorn-57506.exe	42
PID 2680 wrote to memory of 1128	2680	Unicorn-57506.exe	42
PID 2680 wrote to memory of 1128	2680	Unicorn-57506.exe	42
PID 2680 wrote to memory of 1128	2680	Unicorn-57506.exe	42
PID 1276 wrote to memory of 2268	1276	Unicorn-29001.exe	44
PID 1276 wrote to memory of 2268	1276	Unicorn-29001.exe	44
PID 1276 wrote to memory of 2268	1276	Unicorn-29001.exe	44
PID 1276 wrote to memory of 2268	1276	Unicorn-29001.exe	44

C:\Users\Admin\AppData\Local\Temp\618cc26d80102abbf416408a16c5234cf9c242000d9275280b25c2b8ae63342e.exe
"C:\Users\Admin\AppData\Local\Temp\618cc26d80102abbf416408a16c5234cf9c242000d9275280b25c2b8ae63342e.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56115.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56115.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39634.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39634.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33194.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33194.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29001.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54356.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22115.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25763.exe
        8⤵
        
        PID:2220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65212.exe
        7⤵
        
        PID:1484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56079.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31526.exe
        9⤵
        
        PID:2468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63383.exe
        8⤵
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61162.exe
        8⤵
        
        PID:3216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35745.exe
        8⤵
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52838.exe
        8⤵
        
        PID:4444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45673.exe
        7⤵
        
        PID:2140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14955.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30104.exe
        7⤵
        
        PID:3776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60243.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46701.exe
        7⤵
        
        PID:4788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54573.exe
        7⤵
        
        PID:5096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18587.exe
        7⤵
        
        PID:5460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50381.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10203.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56616.exe
        6⤵
        
        PID:1792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51236.exe
        6⤵
        
        PID:2624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65025.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10246.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38124.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34946.exe
        8⤵
        
        PID:3496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58438.exe
        8⤵
        
        PID:3152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-601.exe
        8⤵
        
        PID:5036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38615.exe
        8⤵
        
        PID:4972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65412.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14757.exe
        7⤵
        
        PID:3016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44411.exe
        7⤵
        
        PID:3664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51167.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23878.exe
        7⤵
        
        PID:4216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19530.exe
        7⤵
        
        PID:5768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24096.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49381.exe
        6⤵
        
        PID:2696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48910.exe
        6⤵
        
        PID:3096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35745.exe
        6⤵
        
        PID:4040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52838.exe
        6⤵
        
        PID:4460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18642.exe
        6⤵
        
        PID:4564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26053.exe
        6⤵
        
        PID:5164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6062.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20226.exe
        6⤵
        Executes dropped EXE
        
        PID:2060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12667.exe
        7⤵
        
        PID:2336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33227.exe
        7⤵
        
        PID:1664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19412.exe
        7⤵
        
        PID:3196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29824.exe
        7⤵
        
        PID:3512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-925.exe
        7⤵
        
        PID:4584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34353.exe
        7⤵
        
        PID:4732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13798.exe
        6⤵
        
        PID:2064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14098.exe
        6⤵
        
        PID:2724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53452.exe
        6⤵
        
        PID:3572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52838.exe
        6⤵
        
        PID:4428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26811.exe
        6⤵
        
        PID:4260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54449.exe
        6⤵
        
        PID:4780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58362.exe
        5⤵
        
        PID:2452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13991.exe
        5⤵
        
        PID:1944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48597.exe
        5⤵
        
        PID:3464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36276.exe
        5⤵
        
        PID:3732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48372.exe
        5⤵
        
        PID:3116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37002.exe
        5⤵
        
        PID:4648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7814.exe
        5⤵
        
        PID:3596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-967.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-967.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61502.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2846.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14989.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54686.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6419.exe
        8⤵
        
        PID:3276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2251.exe
        8⤵
        
        PID:4596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23270.exe
        8⤵
        
        PID:4784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45108.exe
        8⤵
        
        PID:4736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34685.exe
        7⤵
        
        PID:268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31012.exe
        7⤵
        
        PID:3420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35745.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52838.exe
        7⤵
        
        PID:4368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26811.exe
        7⤵
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19447.exe
        7⤵
        
        PID:4828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36156.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45055.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38396.exe
        7⤵
        
        PID:4824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30035.exe
        7⤵
        
        PID:4300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48421.exe
        6⤵
        
        PID:2672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36959.exe
        6⤵
        
        PID:2596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35745.exe
        6⤵
        
        PID:4068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52838.exe
        6⤵
        
        PID:4468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18642.exe
        6⤵
        
        PID:4492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4564.exe
        6⤵
        
        PID:5248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42487.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8583.exe
        6⤵
        
        PID:1996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50586.exe
        6⤵
        
        PID:2636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44088.exe
        6⤵
        
        PID:3864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10368.exe
        6⤵
        
        PID:3400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51167.exe
        6⤵
        
        PID:4884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60827.exe
        6⤵
        
        PID:3580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52394.exe
        6⤵
        
        PID:5620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6537.exe
        5⤵
        
        PID:1168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52828.exe
        5⤵
        
        PID:1616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16612.exe
        5⤵
        
        PID:3236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4623.exe
        5⤵
        
        PID:3592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1263.exe
        5⤵
        
        PID:4700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29888.exe
        5⤵
        
        PID:4776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15984.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15984.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62353.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7589.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10861.exe
        7⤵
        
        PID:2496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7519.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38546.exe
        7⤵
        
        PID:3624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12501.exe
        7⤵
        
        PID:4160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56206.exe
        7⤵
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6442.exe
        7⤵
        
        PID:5448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37015.exe
        6⤵
        
        PID:904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56558.exe
        6⤵
        
        PID:2204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56249.exe
        6⤵
        
        PID:3136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11696.exe
        6⤵
        
        PID:4516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2306.exe
        6⤵
        
        PID:4684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24107.exe
        6⤵
        
        PID:4940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32648.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64089.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45563.exe
        6⤵
        
        PID:852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38546.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12501.exe
        6⤵
        
        PID:4144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63338.exe
        6⤵
        
        PID:5024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13414.exe
        6⤵
        
        PID:4976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48421.exe
        5⤵
        
        PID:2164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47073.exe
        5⤵
        
        PID:2332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35745.exe
        5⤵
        
        PID:4024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52838.exe
        5⤵
        
        PID:4360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26811.exe
        5⤵
        
        PID:4384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58533.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39421.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39421.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64437.exe
        5⤵
        
        PID:3392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10223.exe
        5⤵
        
        PID:3540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21432.exe
        5⤵
        
        PID:1504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29949.exe
        5⤵
        
        PID:3892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14702.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14702.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59013.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59013.exe
      4⤵
      PID:936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36276.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36276.exe
      4⤵
      PID:3804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19739.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19739.exe
      4⤵
      PID:4280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43529.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43529.exe
      4⤵
      PID:4952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40181.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40181.exe
      4⤵
      PID:5972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37640.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37640.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9540.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62078.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58627.exe
        6⤵
        
        PID:2256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3056.exe
        6⤵
        
        PID:2192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53927.exe
        6⤵
        
        PID:3304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25833.exe
        6⤵
        
        PID:3976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11625.exe
        6⤵
        
        PID:3860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12381.exe
        6⤵
        
        PID:4284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64444.exe
        6⤵
        
        PID:4168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8949.exe
        6⤵
        
        PID:4124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38761.exe
        5⤵
        
        PID:1740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16791.exe
        5⤵
        
        PID:2296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20705.exe
        5⤵
        
        PID:3348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35745.exe
        5⤵
        
        PID:4060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52838.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18642.exe
        5⤵
        
        PID:4604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26053.exe
        5⤵
        
        PID:5156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34729.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34729.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7589.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1604.exe
        6⤵
        
        PID:4188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4759.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15225.exe
        5⤵
        
        PID:2300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43045.exe
        5⤵
        
        PID:1988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44411.exe
        5⤵
        
        PID:3920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51167.exe
        5⤵
        
        PID:4916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26017.exe
        5⤵
        
        PID:3460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9416.exe
        5⤵
        
        PID:5660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38216.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31526.exe
        5⤵
        
        PID:2260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45563.exe
        5⤵
        
        PID:1560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38546.exe
        5⤵
        
        PID:3688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12501.exe
        5⤵
        
        PID:4136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29563.exe
        5⤵
        
        PID:4992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41253.exe
        5⤵
        
        PID:5472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17446.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17446.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56498.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56498.exe
      4⤵
      PID:2228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19210.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19210.exe
      4⤵
      PID:3612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46701.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46701.exe
      4⤵
      PID:4796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64688.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64688.exe
      4⤵
      PID:3632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49121.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49121.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3410.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3410.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39136.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39136.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40729.exe
        5⤵
        
        PID:2580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3056.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53927.exe
        5⤵
        
        PID:3328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64727.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11625.exe
        5⤵
        
        PID:3896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52838.exe
        5⤵
        
        PID:4412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26811.exe
        5⤵
        
        PID:4344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58533.exe
        5⤵
        
        PID:5092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37583.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37583.exe
      4⤵
      PID:3028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15407.exe
        5⤵
        
        PID:3852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56305.exe
        5⤵
        
        PID:3284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6636.exe
        5⤵
        
        PID:3112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6466.exe
        5⤵
        
        PID:5040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3575.exe
        5⤵
        
        PID:5572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16791.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16791.exe
      4⤵
      PID:880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20705.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20705.exe
      4⤵
      PID:3312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35745.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35745.exe
      4⤵
      PID:4000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52838.exe
      4⤵
      PID:4388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26811.exe
      4⤵
      PID:3244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58533.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58533.exe
      4⤵
      PID:4660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61237.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61237.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12851.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12851.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64089.exe
        5⤵
        
        PID:2604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45563.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38546.exe
        5⤵
        
        PID:3636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2165.exe
        5⤵
        
        PID:4720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29563.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41253.exe
        5⤵
        
        PID:5492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38769.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38769.exe
      4⤵
      PID:1804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35370.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35370.exe
      4⤵
      PID:1444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44411.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44411.exe
      4⤵
      PID:3916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51167.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51167.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23878.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23878.exe
      4⤵
      PID:4240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42088.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42088.exe
      4⤵
      PID:5780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10719.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10719.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59331.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39434.exe
      4⤵
      PID:4624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29085.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29085.exe
    3⤵
    PID:1576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49244.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49244.exe
    3⤵
    PID:1424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14745.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14745.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43037.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43037.exe
    3⤵
    PID:3608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41202.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41202.exe
    3⤵
    PID:5076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45615.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45615.exe
    3⤵
    PID:4988
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11600.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11600.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57506.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57506.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62249.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62249.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7869.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7589.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8583.exe
        7⤵
        
        PID:952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50586.exe
        7⤵
        
        PID:840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25278.exe
        7⤵
        
        PID:3204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9482.exe
        7⤵
        
        PID:3272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32796.exe
        7⤵
        
        PID:4844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27766.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17306.exe
        6⤵
        
        PID:1456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51047.exe
        6⤵
        
        PID:1412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44411.exe
        6⤵
        
        PID:3752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51167.exe
        6⤵
        
        PID:4892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23878.exe
        6⤵
        
        PID:4204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19530.exe
        6⤵
        
        PID:5748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53261.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41350.exe
        6⤵
        
        PID:4748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16300.exe
        6⤵
        
        PID:4220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45105.exe
        5⤵
        
        PID:2948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20129.exe
        5⤵
        
        PID:3128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35745.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52838.exe
        5⤵
        
        PID:4420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26811.exe
        5⤵
        
        PID:4276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54449.exe
        5⤵
        
        PID:1152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47319.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47319.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61040.exe
        5⤵
        
        PID:2212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60892.exe
        5⤵
        
        PID:924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32904.exe
        5⤵
        
        PID:3764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19906.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51167.exe
        5⤵
        
        PID:4924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60827.exe
        5⤵
        
        PID:3588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60562.exe
        5⤵
        
        PID:5588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53649.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53649.exe
      4⤵
      PID:2800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55137.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55137.exe
      4⤵
      PID:2248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59679.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59679.exe
      4⤵
      PID:3560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19210.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19210.exe
      4⤵
      PID:3704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46701.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46701.exe
      4⤵
      PID:4804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64688.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64688.exe
      4⤵
      PID:5116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49121.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49121.exe
      4⤵
      PID:5700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55212.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55212.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1647.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25763.exe
        5⤵
        
        PID:696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24687.exe
        6⤵
        
        PID:4212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56970.exe
        6⤵
        
        PID:5872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3056.exe
        5⤵
        
        PID:1688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14840.exe
        5⤵
        
        PID:3384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25833.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11625.exe
        5⤵
        
        PID:3840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52838.exe
        5⤵
        
        PID:4452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18642.exe
        5⤵
        
        PID:4616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21969.exe
        5⤵
        
        PID:5220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-940.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-940.exe
      4⤵
      PID:3024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5268.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5268.exe
      4⤵
      PID:1660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-77.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-77.exe
      4⤵
      PID:3192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21688.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21688.exe
      4⤵
      PID:3584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26987.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26987.exe
      4⤵
      PID:4672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59363.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59363.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33005.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33005.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1066.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1066.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63804.exe
        5⤵
        
        PID:4556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56378.exe
        5⤵
        
        PID:4348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27295.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3056.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3056.exe
      4⤵
      PID:1716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13689.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13689.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11241.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11241.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52838.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26811.exe
      4⤵
      PID:4332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58533.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58533.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5653.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5653.exe
    3⤵
    PID:1408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13991.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13991.exe
    3⤵
    PID:2284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61042.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61042.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35248.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35248.exe
    3⤵
    PID:3164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1896.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1896.exe
    3⤵
    PID:4524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45177.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45177.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62719.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62719.exe
    3⤵
    PID:5180
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51376.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51376.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43967.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43967.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42296.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42296.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4024.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44346.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37015.exe
        6⤵
        
        PID:932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54036.exe
        6⤵
        
        PID:2792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44411.exe
        6⤵
        
        PID:3744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51167.exe
        6⤵
        
        PID:4900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23878.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19530.exe
        6⤵
        
        PID:5760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23110.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25543.exe
        6⤵
        
        PID:3288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10223.exe
        6⤵
        
        PID:3536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3725.exe
        6⤵
        
        PID:4572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55470.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20600.exe
        5⤵
        
        PID:2168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48910.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35745.exe
        5⤵
        
        PID:2348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52838.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61621.exe
        5⤵
        
        PID:4496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-537.exe
        5⤵
        
        PID:5892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29659.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29659.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38700.exe
        5⤵
        
        PID:2984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3768.exe
        6⤵
        
        PID:5300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3056.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14840.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62589.exe
        5⤵
        
        PID:4016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15408.exe
        5⤵
        
        PID:2376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11696.exe
        5⤵
        
        PID:4540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2306.exe
        5⤵
        
        PID:4696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26053.exe
        5⤵
        
        PID:5148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52497.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52497.exe
      4⤵
      PID:2216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53736.exe
        5⤵
        
        PID:1916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37316.exe
        5⤵
        
        PID:872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44411.exe
        5⤵
        
        PID:3880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3836.exe
        5⤵
        
        PID:4112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46802.exe
        5⤵
        
        PID:5012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30480.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23446.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23446.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65427.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65427.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36276.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36276.exe
      4⤵
      PID:3796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41366.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41366.exe
      4⤵
      PID:4712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23963.exe
      4⤵
      PID:5072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56388.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56388.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57625.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57625.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21020.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21020.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17712.exe
        5⤵
        
        PID:2996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45563.exe
        5⤵
        
        PID:1084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38546.exe
        5⤵
        
        PID:3696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12501.exe
        5⤵
        
        PID:4252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32611.exe
        5⤵
        
        PID:3504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13414.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22158.exe
      4⤵
      PID:1572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59298.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59298.exe
      4⤵
      PID:2960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14702.exe
        5⤵
        
        PID:4292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44411.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44411.exe
      4⤵
      PID:3760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51167.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51167.exe
      4⤵
      PID:4876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60827.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60827.exe
      4⤵
      PID:3524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56478.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56478.exe
      4⤵
      PID:5608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35694.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35694.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64089.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64089.exe
      4⤵
      PID:1656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45563.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45563.exe
      4⤵
      PID:2444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38546.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38546.exe
      4⤵
      PID:3644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12501.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12501.exe
      4⤵
      PID:4152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29563.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29563.exe
      4⤵
      PID:4984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41253.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41253.exe
      4⤵
      PID:5520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63824.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63824.exe
    3⤵
    PID:692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56498.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56498.exe
    3⤵
    PID:2312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19210.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19210.exe
    3⤵
    PID:3660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15539.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15539.exe
    3⤵
    PID:4296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5728.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5728.exe
    3⤵
    PID:5000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58381.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58381.exe
    3⤵
    PID:5956
- C:\Users\Admin\AppData\Local\Temp\Unicorn-531.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-531.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3593.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3593.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49525.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49525.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32369.exe
        5⤵
        
        PID:1764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49466.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40477.exe
        6⤵
        
        PID:3824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4021.exe
        6⤵
        
        PID:4860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64209.exe
        6⤵
        
        PID:6064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3056.exe
        5⤵
        
        PID:896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14840.exe
        5⤵
        
        PID:3320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9304.exe
        5⤵
        
        PID:3988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54303.exe
        5⤵
        
        PID:4084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11696.exe
        5⤵
        
        PID:4532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2306.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24107.exe
        5⤵
        
        PID:3604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55866.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55866.exe
      4⤵
      PID:628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63804.exe
        5⤵
        
        PID:4608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65122.exe
        5⤵
        
        PID:4752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49854.exe
        5⤵
        
        PID:5188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14653.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14653.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8261.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8261.exe
      4⤵
      PID:3476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35745.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35745.exe
      4⤵
      PID:3984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52838.exe
      4⤵
      PID:4436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18642.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18642.exe
      4⤵
      PID:4632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15747.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15747.exe
      4⤵
      PID:2116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56302.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56302.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17520.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17520.exe
      4⤵
      PID:2484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45563.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45563.exe
      4⤵
      PID:1936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38546.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38546.exe
      4⤵
      PID:3652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12501.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12501.exe
      4⤵
      PID:4128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56206.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56206.exe
      4⤵
      PID:5044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41253.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41253.exe
      4⤵
      PID:5500
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39594.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39594.exe
    3⤵
    PID:2676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14955.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14955.exe
    3⤵
    PID:1968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30104.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30104.exe
    3⤵
    PID:3784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17264.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17264.exe
    3⤵
    PID:3228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4366.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4366.exe
    3⤵
    PID:3472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42337.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42337.exe
    3⤵
    PID:5084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3614.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3614.exe
    3⤵
    PID:4640
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41534.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41534.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12192.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12192.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49006.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49006.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3056.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3056.exe
      4⤵
      PID:3064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14840.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14840.exe
      4⤵
      PID:3368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25833.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25833.exe
      4⤵
      PID:3956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11625.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11625.exe
      4⤵
      PID:3848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52838.exe
      4⤵
      PID:4376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61621.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61621.exe
      4⤵
      PID:4504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27807.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27807.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27002.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27002.exe
    3⤵
    PID:1744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16791.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16791.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59792.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59792.exe
    3⤵
    PID:3336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35745.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35745.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52838.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52838.exe
    3⤵
    PID:4352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26811.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26811.exe
    3⤵
    PID:4336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58533.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58533.exe
    3⤵
    PID:4964
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44095.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44095.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-451.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-451.exe
    3⤵
    PID:2272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31093.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31093.exe
    3⤵
    PID:2184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44411.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44411.exe
    3⤵
    PID:3944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51167.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51167.exe
    3⤵
    PID:4908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26017.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26017.exe
    3⤵
    PID:3888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50256.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50256.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5720
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63198.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63198.exe
  2⤵
  PID:1708
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50826.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50826.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1748
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35372.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35372.exe
  2⤵
  PID:3816
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57357.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57357.exe
  2⤵
  PID:3172
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19502.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19502.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3912
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60803.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60803.exe
  2⤵
  PID:4996
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42815.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42815.exe
  2⤵
  PID:3668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-29001.exe

Filesize
468KB

MD5
f49113ee0c905771d8a0feebd02c3169

SHA1
94b75ae197b248d4c32a8d452f13b08c6155bc6a

SHA256
ab9596902aeabe075eb3c0b7d7f80db64f1bfb920db43afe8c4881a2b7735985

SHA512
fb89b2662587f6068b9b1aab13efce028dae12370838568cf061962f38ac7792b97dbde4cdea25d8774f04bad2a3dc3b981f5c6469f5df30b57ea1c0a5c6f3ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33194.exe

Filesize
468KB

MD5
0bffaaf97c07e3f4c302ba242ac4709b

SHA1
a08f4f48635c43e0029b0a65801c1ea21b4303a6

SHA256
cb499baa49d98c6e2a925e02e0bd50be05b8a55efdcd9ffc10fe398f12876116

SHA512
0d325b952d88a8d82da0f447a218093bedfe1dcc9e49a9ac99e73ae06bf39961a700ce859d7ee3889c27d39ac4a886a8a08e448b3f862f250a981e758267e783

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55212.exe

Filesize
468KB

MD5
965fe57fd2db3a7808985aecbf998b96

SHA1
2b82c48012d88f39945f46c9fd7ba2d8aa257c88

SHA256
b058fa5d97549f8fbac7f03d8fd8976571410d972cdf17c4ef32ef5108861388

SHA512
af29e170f0997ecaca633088dabd333d945b5e4e035b6bfaff4e4da1b58f0a548e549a33e8a6bf9699be1ee51ee4afa57314805a5bc910942a139aa0da68bf4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57506.exe

Filesize
468KB

MD5
b2ff3b1af9cdc0a64ad84f87cffe1db6

SHA1
e0194f4cae775a927005df5a1871db37a97d1909

SHA256
835034a359a0e5c1d60c8f2b2d69813016544cabefbf48fd15640f30f6f99e83

SHA512
b0cb3b9b11b66def7db95f884fe12d3dcdc43f7fd7b99dd1148bc399692658ee06b906e46f62b83b973180d74c0d045d703d4a7300dec3e1087ea273d21bda94

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-11600.exe

Filesize
468KB

MD5
c29a7907a509b484162fccfb154befe3

SHA1
eda02fca6acb798af9d6a6c8e4bb45343f50f67b

SHA256
4f96d0acf644fb3d9a7bd4d564bdd160cba3389b63c49579a43fb6ebcc465b0a

SHA512
04f628372a9f84a13a8d5db811281b1bfa68df16820c6312a3adfe42d9a6891f774370d1b3b262e711ab2c6955120acc3153e808fc5aa10a219c6fa2342d80bf

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-3410.exe

Filesize
468KB

MD5
d324554a9320a3b606ca443fb05fa2b3

SHA1
98422000b7465145a6ccff759c387dece3fe1f71

SHA256
8f66a39ce4b668c8cbd0b5d6110f1c8f602dd09cb09b717fea628117b85cf0be

SHA512
8edf6b8656d82767dabddf9a79047acc2a16ed956693b07458c05ceed6971d239f761d8a799624db3db67569f9dfb45b25e2275208a4a3b35ee443f0c1c3c804

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-3593.exe

Filesize
468KB

MD5
41170cba402371dc61d5f439cb5e2bd3

SHA1
5b3e9282e132b26f13f57589bdc21232ea50369e

SHA256
73f7ac8f07c3f7bde217942f4e04f495df38656a2183b2a29ca3e6610fbc6089

SHA512
ff3dc0ca264d3fb5ea07058b25adf79e5fda989f6fe97a7c411f958253d234643dee172a500e7df18eb00927d6b571ffc884bf7514a7193fcaaf9792bc54c83b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-37640.exe

Filesize
468KB

MD5
3136c5db112f6f3aa2ee9e1697b6235d

SHA1
1218b6f1853490e7507eefac25756bfa2da6af66

SHA256
9c01883b9671e1a8bb1915e578d0c719596b87f627b456d9bb04d66090e5e16c

SHA512
6f4ef0fefd8fd6548ef143c72b3b13b0f44382f828b250cd65b66f04f6dd3a29e554b201808e23e82610e22c198942b2a68544f0cce70740246669f38b6ec3b8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-39634.exe

Filesize
468KB

MD5
14e52e617be8ceacd60c8f9b1ca1fffb

SHA1
f35da500b5b79c63c253bf5e4e2b5d0265ba24df

SHA256
97da895c7d473b43801145c9deb147eb63eb082639a3d60e47bf0e75dbe7a336

SHA512
174102e920115894c5d10d7d44eae256301f2de40eb33e711122b6442c9bc2e75b922b1caf634a1a6946019491b069dea88ac89acb3476c0a486ea09a9bf79a9

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-43967.exe

Filesize
468KB

MD5
36f9bcf77ea800bca16519696b232baa

SHA1
4ea071bb97d8bf3cd62e737615f276ac32e78a16

SHA256
63c5b14959b357e9e21bbca1c69206e557bd3e902c8ece111f783b06741416f9

SHA512
30c0784f99d7ac64b9bc2d60cbf9d681595018402835e783062af84646537ca4d964d5d0cca87dba3788ed7dff09050bcea75ef8eeeb08a55a102c62202fb7d7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-51376.exe

Filesize
468KB

MD5
527992d2ba564141e54186db92d76689

SHA1
746e958fa4dca740060e2e6814ad8bdb11ebdc0a

SHA256
8a6e3f148b002acb688043d7065b45d4e6fd64458c630eeecc195f87270c6c55

SHA512
9f6faee864f8be47ea6708c3dd041197196aa20ef0b3475bfc6991876b0f9d145e5db0d00d750a3b574ac5af6f9233d125e4f27ab7535f9a5b5bd812153b457a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-531.exe

Filesize
468KB

MD5
977bb5460f9cb05de9bd0db2c6b43b9f

SHA1
cf6591a377c9700e7b4b182328c37e54403d0fd2

SHA256
c3c1ae42aa7bfb576a9fb50e4432ef43a7c3c22ee04a54d5477c0632fc563efe

SHA512
b831ab71a85854c414b332c8892c280c2677ebeb767e0c344153cd7b64c15c11fb490deaa34f78bdc3d4d22681cec8c61211f9eb326cbe814537de669d8eba71

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-54356.exe

Filesize
468KB

MD5
dfee45e47b45ed89c126f8b4cc9674a5

SHA1
fed22b00c25459ba588ce6a0c71b69190d82846f

SHA256
c88c0d383d2a3849adb2ce87e7adce40edc8a3410bbfe781021d3b8b6bdbf00c

SHA512
9b33879f69287d57b0d343c716c253048ec07d2082d8e4a69626bf444120e93c1237817ed39e2b6bc7329e7f4e7f94e0fd593ff2cd4fb7b369eca0f96663869c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-56115.exe

Filesize
468KB

MD5
5ee48c11b577c44fe9e4c4382723ecdb

SHA1
de25a9e96f9d3d028de513581dad8d6accd7cc83

SHA256
64c99dd3648212261cba6752b2767a50e6afb0bd448c75207b03e703f9b9be62

SHA512
6dc7ace8fff023485048b7b2cd048dd2b5f50a34589f1f46c6964e086adf93abd2ba5ffaf11b80a58263a74ef2d0a53d6d79339711eaabcd0ccffdf0dc996a1c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-62249.exe

Filesize
468KB

MD5
53894f62fb4ce4f612823081a7b2f905

SHA1
e38c66903d2c919352b1b9a47de814591784e37d

SHA256
bb5d81e7981efdabd1440fac1e99d0195175989595d63f26ae58726c0450dcc0

SHA512
4c994bb5967ab69fde09ed2a28eda7572cb506e4f65682848779e385559158a3e17838596e661705020db80b8e9298df8afdd11320d5bb928afee9b115de1cc0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-65025.exe

Filesize
468KB

MD5
281f77b5ac01c054b06089f2fe492b77

SHA1
d98cd1c1f1735ed201d7635b8ecd609db122030d

SHA256
081b357e69c98d0f03eff9c72cc625d37b88d7b5e69c710418024b64c49c584b

SHA512
e4b353fe6e74490509f18695d3154a63ae1633800edcfc8ca00aeec0c4b4db6f33cca36def1dd6ca2216c8d864688f846467c8a93ba0706a0c6bab5406b222b9

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-9540.exe

Filesize
468KB

MD5
796d989a71bad2b3ecfa9fe10c3b292c

SHA1
ef545054446f8076b0c06167a59aef2b5a793ac1

SHA256
abc83372b887b8651f72c198196f1adffadb0b6103be8bbb7858ad78570a4b23

SHA512
cb8fe8fe991651be16be00967ac86d8fc4a02cbdc6a361cb49180a4ebe231aea1ead83ccd15c675f2106d09c2329abb307a845a924318a012fd84ee5a010205e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-967.exe

Filesize
468KB

MD5
125b7fd45c9960e48eea4c7f05e64133

SHA1
30976ff8ba05e6c089b641f22b1a780e13ef823b

SHA256
8944de68b6dd6b74fad21f62f7191e1e72efa78dbcb4e0627416f96c64f323b9

SHA512
d624f85826c07edae5edcea6271c9a36136cb47da5493e347d803594acab15ea68901e323316261edb6dcb833ca6e9fc7189f7a20acb907c7c638a70d487389b

Download Submit
memory/548-402-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/636-274-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/956-226-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1052-414-0x0000000002650000-0x00000000026C5000-memory.dmp

Filesize
468KB

Download
memory/1052-244-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1052-411-0x0000000002650000-0x00000000026C5000-memory.dmp

Filesize
468KB

Download
memory/1128-270-0x0000000001D70000-0x0000000001DE5000-memory.dmp

Filesize
468KB

Download
memory/1128-174-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1128-260-0x0000000001D70000-0x0000000001DE5000-memory.dmp

Filesize
468KB

Download
memory/1148-169-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1148-299-0x0000000002590000-0x0000000002605000-memory.dmp

Filesize
468KB

Download
memory/1148-300-0x0000000002590000-0x0000000002605000-memory.dmp

Filesize
468KB

Download
memory/1276-347-0x00000000025B0000-0x0000000002625000-memory.dmp

Filesize
468KB

Download
memory/1276-345-0x00000000025B0000-0x0000000002625000-memory.dmp

Filesize
468KB

Download
memory/1276-196-0x00000000025B0000-0x0000000002625000-memory.dmp

Filesize
468KB

Download
memory/1276-197-0x00000000025B0000-0x0000000002625000-memory.dmp

Filesize
468KB

Download
memory/1276-106-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1452-258-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1544-271-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1724-243-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1724-398-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1724-397-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1796-375-0x00000000025B0000-0x0000000002625000-memory.dmp

Filesize
468KB

Download
memory/1796-376-0x00000000025B0000-0x0000000002625000-memory.dmp

Filesize
468KB

Download
memory/1796-212-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1972-272-0x0000000002540000-0x00000000025B5000-memory.dmp

Filesize
468KB

Download
memory/1972-178-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2056-10-0x0000000002590000-0x0000000002605000-memory.dmp

Filesize
468KB

Download
memory/2056-413-0x0000000002590000-0x0000000002605000-memory.dmp

Filesize
468KB

Download
memory/2056-240-0x0000000002590000-0x0000000002605000-memory.dmp

Filesize
468KB

Download
memory/2056-242-0x0000000002590000-0x0000000002605000-memory.dmp

Filesize
468KB

Download
memory/2056-412-0x0000000002590000-0x0000000002605000-memory.dmp

Filesize
468KB

Download
memory/2056-122-0x0000000002590000-0x0000000002605000-memory.dmp

Filesize
468KB

Download
memory/2056-33-0x0000000002590000-0x0000000002605000-memory.dmp

Filesize
468KB

Download
memory/2056-11-0x0000000002590000-0x0000000002605000-memory.dmp

Filesize
468KB

Download
memory/2056-127-0x0000000002590000-0x0000000002605000-memory.dmp

Filesize
468KB

Download
memory/2056-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2080-301-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2100-401-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2104-415-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2160-321-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2268-351-0x0000000000360000-0x00000000003D5000-memory.dmp

Filesize
468KB

Download
memory/2268-352-0x0000000000360000-0x00000000003D5000-memory.dmp

Filesize
468KB

Download
memory/2268-199-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2280-362-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2292-317-0x00000000027F0000-0x0000000002865000-memory.dmp

Filesize
468KB

Download
memory/2292-316-0x00000000027F0000-0x0000000002865000-memory.dmp

Filesize
468KB

Download
memory/2292-107-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2392-294-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2424-378-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2528-129-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2528-225-0x0000000002940000-0x00000000029B5000-memory.dmp

Filesize
468KB

Download
memory/2528-219-0x0000000002940000-0x00000000029B5000-memory.dmp

Filesize
468KB

Download
memory/2552-416-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2648-170-0x0000000002930000-0x00000000029A5000-memory.dmp

Filesize
468KB

Download
memory/2648-364-0x0000000002930000-0x00000000029A5000-memory.dmp

Filesize
468KB

Download
memory/2648-368-0x0000000002930000-0x00000000029A5000-memory.dmp

Filesize
468KB

Download
memory/2648-171-0x0000000002930000-0x00000000029A5000-memory.dmp

Filesize
468KB

Download
memory/2656-369-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2680-285-0x0000000002570000-0x00000000025E5000-memory.dmp

Filesize
468KB

Download
memory/2680-172-0x0000000002570000-0x00000000025E5000-memory.dmp

Filesize
468KB

Download
memory/2680-286-0x0000000002570000-0x00000000025E5000-memory.dmp

Filesize
468KB

Download
memory/2680-79-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2748-353-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2752-256-0x0000000000AB0000-0x0000000000B25000-memory.dmp

Filesize
468KB

Download
memory/2752-257-0x0000000000AB0000-0x0000000000B25000-memory.dmp

Filesize
468KB

Download
memory/2752-78-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2816-289-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2824-210-0x0000000002670000-0x00000000026E5000-memory.dmp

Filesize
468KB

Download
memory/2824-50-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2824-399-0x0000000002670000-0x00000000026E5000-memory.dmp

Filesize
468KB

Download
memory/2824-400-0x0000000002670000-0x00000000026E5000-memory.dmp

Filesize
468KB

Download
memory/2824-105-0x0000000002670000-0x00000000026E5000-memory.dmp

Filesize
468KB

Download
memory/2824-209-0x0000000002670000-0x00000000026E5000-memory.dmp

Filesize
468KB

Download
memory/2828-145-0x0000000001E20000-0x0000000001E95000-memory.dmp

Filesize
468KB

Download
memory/2828-319-0x0000000001E20000-0x0000000001E95000-memory.dmp

Filesize
468KB

Download
memory/2828-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2828-144-0x0000000001E20000-0x0000000001E95000-memory.dmp

Filesize
468KB

Download
memory/2828-315-0x0000000001E20000-0x0000000001E95000-memory.dmp

Filesize
468KB

Download
memory/2828-21-0x0000000001E20000-0x0000000001E95000-memory.dmp

Filesize
468KB

Download
memory/2832-356-0x0000000002470000-0x00000000024E5000-memory.dmp

Filesize
468KB

Download
memory/2832-176-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2832-361-0x0000000002470000-0x00000000024E5000-memory.dmp

Filesize
468KB

Download
memory/2840-350-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2860-49-0x0000000000510000-0x0000000000585000-memory.dmp

Filesize
468KB

Download
memory/2860-348-0x0000000000510000-0x0000000000585000-memory.dmp

Filesize
468KB

Download
memory/2860-349-0x0000000000510000-0x0000000000585000-memory.dmp

Filesize
468KB

Download
memory/2868-173-0x0000000000370000-0x00000000003E5000-memory.dmp

Filesize
468KB

Download
memory/2868-37-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2868-175-0x0000000000370000-0x00000000003E5000-memory.dmp

Filesize
468KB

Download
memory/2868-287-0x0000000000370000-0x00000000003E5000-memory.dmp

Filesize
468KB

Download
memory/2892-354-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2972-117-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2972-239-0x00000000025E0000-0x0000000002655000-memory.dmp

Filesize
468KB

Download
memory/2972-241-0x00000000025E0000-0x0000000002655000-memory.dmp

Filesize
468KB

Download
memory/2988-320-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download