08e268f6bc0e49d29284a225387aba7c791edd851c65a806ce8f0653d94f8a11

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/10/2024, 16:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

08e268f6bc0e49d29284a225387aba7c791edd851c65a806ce8f0653d94f8a11N.exe
Size

468KB
MD5

ec46911c6e870ccfdace9aa9125d6cc0
SHA1

223ec8ff244f67ee832ec754d8985501cd82f7b1
SHA256

08e268f6bc0e49d29284a225387aba7c791edd851c65a806ce8f0653d94f8a11
SHA512

955a2c9ff3efca028af8ccad41f49515ba2eead786be8e8daefb42414e18e77c23a095584215eb3f5c353c7c63051156aaa50211b57a0ceecc6e74f945aa59f6
SSDEEP

3072:aQoHogIK+05QtbYJHzcOMfr/MCwzPmp9nLHeaVPnZwMLXeDg62ld:aQIoN8QtOH4OMfImQCZwmODg6

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2504	Unicorn-59395.exe
2444	Unicorn-64452.exe
1356	Unicorn-23934.exe
2556	Unicorn-35776.exe
2872	Unicorn-23524.exe
2892	Unicorn-33729.exe
1680	Unicorn-19994.exe
2668	Unicorn-37395.exe
1688	Unicorn-33865.exe
2832	Unicorn-54655.exe
1032	Unicorn-54655.exe
372	Unicorn-54390.exe
2904	Unicorn-54655.exe
1208	Unicorn-55210.exe
2040	Unicorn-56693.exe
1336	Unicorn-46653.exe
2836	Unicorn-15049.exe
2364	Unicorn-15634.exe
1708	Unicorn-1899.exe
2968	Unicorn-38293.exe
3060	Unicorn-34763.exe
2416	Unicorn-54629.exe
1328	Unicorn-5620.exe
868	Unicorn-5355.exe
492	Unicorn-21957.exe
1640	Unicorn-15826.exe
1368	Unicorn-30322.exe
596	Unicorn-39253.exe
3052	Unicorn-35723.exe
1948	Unicorn-55589.exe
1824	Unicorn-52252.exe
684	Unicorn-2963.exe
2052	Unicorn-39912.exe
532	Unicorn-20046.exe
1592	Unicorn-24322.exe
2024	Unicorn-19108.exe
2448	Unicorn-51707.exe
2704	Unicorn-16176.exe
2876	Unicorn-29174.exe
2724	Unicorn-49040.exe
3048	Unicorn-1877.exe
2712	Unicorn-3923.exe
2592	Unicorn-28598.exe
2616	Unicorn-1301.exe
1232	Unicorn-7431.exe
1912	Unicorn-10.exe
2352	Unicorn-19876.exe
2012	Unicorn-7301.exe
2500	Unicorn-39419.exe
576	Unicorn-59994.exe
1852	Unicorn-19923.exe
1220	Unicorn-19923.exe
1280	Unicorn-32921.exe
316	Unicorn-41089.exe
3004	Unicorn-60955.exe
1968	Unicorn-3586.exe
2104	Unicorn-3586.exe
3012	Unicorn-7670.exe
3068	Unicorn-51946.exe
980	Unicorn-29744.exe
392	Unicorn-22860.exe
1720	Unicorn-25660.exe
896	Unicorn-4354.exe
1376	Unicorn-25521.exe

Loads dropped DLL 64 IoCs

pid	Process
2348	08e268f6bc0e49d29284a225387aba7c791edd851c65a806ce8f0653d94f8a11N.exe
2348	08e268f6bc0e49d29284a225387aba7c791edd851c65a806ce8f0653d94f8a11N.exe
2504	Unicorn-59395.exe
2348	08e268f6bc0e49d29284a225387aba7c791edd851c65a806ce8f0653d94f8a11N.exe
2348	08e268f6bc0e49d29284a225387aba7c791edd851c65a806ce8f0653d94f8a11N.exe
2504	Unicorn-59395.exe
1356	Unicorn-23934.exe
2444	Unicorn-64452.exe
2444	Unicorn-64452.exe
1356	Unicorn-23934.exe
2348	08e268f6bc0e49d29284a225387aba7c791edd851c65a806ce8f0653d94f8a11N.exe
2348	08e268f6bc0e49d29284a225387aba7c791edd851c65a806ce8f0653d94f8a11N.exe
2504	Unicorn-59395.exe
2504	Unicorn-59395.exe
2556	Unicorn-35776.exe
2556	Unicorn-35776.exe
2444	Unicorn-64452.exe
2444	Unicorn-64452.exe
2348	08e268f6bc0e49d29284a225387aba7c791edd851c65a806ce8f0653d94f8a11N.exe
2348	08e268f6bc0e49d29284a225387aba7c791edd851c65a806ce8f0653d94f8a11N.exe
1680	Unicorn-19994.exe
2872	Unicorn-23524.exe
2892	Unicorn-33729.exe
1680	Unicorn-19994.exe
2892	Unicorn-33729.exe
2872	Unicorn-23524.exe
2504	Unicorn-59395.exe
2504	Unicorn-59395.exe
1356	Unicorn-23934.exe
1356	Unicorn-23934.exe
1688	Unicorn-33865.exe
1688	Unicorn-33865.exe
2832	Unicorn-54655.exe
2832	Unicorn-54655.exe
1680	Unicorn-19994.exe
1680	Unicorn-19994.exe
2444	Unicorn-64452.exe
2444	Unicorn-64452.exe
1032	Unicorn-54655.exe
1032	Unicorn-54655.exe
2892	Unicorn-33729.exe
2892	Unicorn-33729.exe
2040	Unicorn-56693.exe
2040	Unicorn-56693.exe
1208	Unicorn-55210.exe
1208	Unicorn-55210.exe
2504	Unicorn-59395.exe
2504	Unicorn-59395.exe
1356	Unicorn-23934.exe
372	Unicorn-54390.exe
1356	Unicorn-23934.exe
372	Unicorn-54390.exe
2348	08e268f6bc0e49d29284a225387aba7c791edd851c65a806ce8f0653d94f8a11N.exe
2348	08e268f6bc0e49d29284a225387aba7c791edd851c65a806ce8f0653d94f8a11N.exe
2904	Unicorn-54655.exe
2904	Unicorn-54655.exe
2872	Unicorn-23524.exe
2872	Unicorn-23524.exe
2668	Unicorn-37395.exe
2668	Unicorn-37395.exe
2556	Unicorn-35776.exe
2556	Unicorn-35776.exe
2836	Unicorn-15049.exe
2836	Unicorn-15049.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29673.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29475.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11624.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28994.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51936.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10592.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23609.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23609.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52252.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24282.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62553.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10592.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29475.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54655.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38293.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62232.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40609.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23609.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34156.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45003.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1697.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47634.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23609.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55589.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29103.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48018.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10592.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29673.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20809.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29475.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28864.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49274.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25589.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17116.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59938.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20994.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25589.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46653.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10986.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43409.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20809.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20809.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58255.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50409.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47634.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43409.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25589.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-726.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23609.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47176.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62756.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23609.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23609.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13098.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4274.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16176.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7811.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56529.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51184.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3913.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39325.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23609.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5999.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17171.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2348	08e268f6bc0e49d29284a225387aba7c791edd851c65a806ce8f0653d94f8a11N.exe
2504	Unicorn-59395.exe
1356	Unicorn-23934.exe
2444	Unicorn-64452.exe
2872	Unicorn-23524.exe
2556	Unicorn-35776.exe
2892	Unicorn-33729.exe
1680	Unicorn-19994.exe
1688	Unicorn-33865.exe
2832	Unicorn-54655.exe
1032	Unicorn-54655.exe
2668	Unicorn-37395.exe
1208	Unicorn-55210.exe
2040	Unicorn-56693.exe
372	Unicorn-54390.exe
2904	Unicorn-54655.exe
1336	Unicorn-46653.exe
2836	Unicorn-15049.exe
1708	Unicorn-1899.exe
2364	Unicorn-15634.exe
2968	Unicorn-38293.exe
3060	Unicorn-34763.exe
2416	Unicorn-54629.exe
1328	Unicorn-5620.exe
492	Unicorn-21957.exe
868	Unicorn-5355.exe
1640	Unicorn-15826.exe
1368	Unicorn-30322.exe
596	Unicorn-39253.exe
3052	Unicorn-35723.exe
1948	Unicorn-55589.exe
1824	Unicorn-52252.exe
684	Unicorn-2963.exe
2052	Unicorn-39912.exe
532	Unicorn-20046.exe
1592	Unicorn-24322.exe
2024	Unicorn-19108.exe
2448	Unicorn-51707.exe
2704	Unicorn-16176.exe
2876	Unicorn-29174.exe
2724	Unicorn-49040.exe
3048	Unicorn-1877.exe
2712	Unicorn-3923.exe
2592	Unicorn-28598.exe
2616	Unicorn-1301.exe
1232	Unicorn-7431.exe
2352	Unicorn-19876.exe
1912	Unicorn-10.exe
2012	Unicorn-7301.exe
2500	Unicorn-39419.exe
1852	Unicorn-19923.exe
1280	Unicorn-32921.exe
576	Unicorn-59994.exe
1220	Unicorn-19923.exe
3004	Unicorn-60955.exe
316	Unicorn-41089.exe
2104	Unicorn-3586.exe
1968	Unicorn-3586.exe
3012	Unicorn-7670.exe
3068	Unicorn-51946.exe
1720	Unicorn-25660.exe
980	Unicorn-29744.exe
392	Unicorn-22860.exe
896	Unicorn-4354.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2504	2348	08e268f6bc0e49d29284a225387aba7c791edd851c65a806ce8f0653d94f8a11N.exe	30
PID 2348 wrote to memory of 2504	2348	08e268f6bc0e49d29284a225387aba7c791edd851c65a806ce8f0653d94f8a11N.exe	30
PID 2348 wrote to memory of 2504	2348	08e268f6bc0e49d29284a225387aba7c791edd851c65a806ce8f0653d94f8a11N.exe	30
PID 2348 wrote to memory of 2504	2348	08e268f6bc0e49d29284a225387aba7c791edd851c65a806ce8f0653d94f8a11N.exe	30
PID 2348 wrote to memory of 2444	2348	08e268f6bc0e49d29284a225387aba7c791edd851c65a806ce8f0653d94f8a11N.exe	33
PID 2348 wrote to memory of 2444	2348	08e268f6bc0e49d29284a225387aba7c791edd851c65a806ce8f0653d94f8a11N.exe	33
PID 2348 wrote to memory of 2444	2348	08e268f6bc0e49d29284a225387aba7c791edd851c65a806ce8f0653d94f8a11N.exe	33
PID 2348 wrote to memory of 2444	2348	08e268f6bc0e49d29284a225387aba7c791edd851c65a806ce8f0653d94f8a11N.exe	33
PID 2504 wrote to memory of 1356	2504	Unicorn-59395.exe	32
PID 2504 wrote to memory of 1356	2504	Unicorn-59395.exe	32
PID 2504 wrote to memory of 1356	2504	Unicorn-59395.exe	32
PID 2504 wrote to memory of 1356	2504	Unicorn-59395.exe	32
PID 1356 wrote to memory of 2872	1356	Unicorn-23934.exe	34
PID 1356 wrote to memory of 2872	1356	Unicorn-23934.exe	34
PID 2444 wrote to memory of 2556	2444	Unicorn-64452.exe	35
PID 1356 wrote to memory of 2872	1356	Unicorn-23934.exe	34
PID 1356 wrote to memory of 2872	1356	Unicorn-23934.exe	34
PID 2444 wrote to memory of 2556	2444	Unicorn-64452.exe	35
PID 2444 wrote to memory of 2556	2444	Unicorn-64452.exe	35
PID 2444 wrote to memory of 2556	2444	Unicorn-64452.exe	35
PID 2348 wrote to memory of 2892	2348	08e268f6bc0e49d29284a225387aba7c791edd851c65a806ce8f0653d94f8a11N.exe	36
PID 2348 wrote to memory of 2892	2348	08e268f6bc0e49d29284a225387aba7c791edd851c65a806ce8f0653d94f8a11N.exe	36
PID 2348 wrote to memory of 2892	2348	08e268f6bc0e49d29284a225387aba7c791edd851c65a806ce8f0653d94f8a11N.exe	36
PID 2348 wrote to memory of 2892	2348	08e268f6bc0e49d29284a225387aba7c791edd851c65a806ce8f0653d94f8a11N.exe	36
PID 2504 wrote to memory of 1680	2504	Unicorn-59395.exe	37
PID 2504 wrote to memory of 1680	2504	Unicorn-59395.exe	37
PID 2504 wrote to memory of 1680	2504	Unicorn-59395.exe	37
PID 2504 wrote to memory of 1680	2504	Unicorn-59395.exe	37
PID 2556 wrote to memory of 2668	2556	Unicorn-35776.exe	38
PID 2556 wrote to memory of 2668	2556	Unicorn-35776.exe	38
PID 2556 wrote to memory of 2668	2556	Unicorn-35776.exe	38
PID 2556 wrote to memory of 2668	2556	Unicorn-35776.exe	38
PID 2444 wrote to memory of 1688	2444	Unicorn-64452.exe	39
PID 2444 wrote to memory of 1688	2444	Unicorn-64452.exe	39
PID 2444 wrote to memory of 1688	2444	Unicorn-64452.exe	39
PID 2444 wrote to memory of 1688	2444	Unicorn-64452.exe	39
PID 2348 wrote to memory of 372	2348	08e268f6bc0e49d29284a225387aba7c791edd851c65a806ce8f0653d94f8a11N.exe	40
PID 2348 wrote to memory of 372	2348	08e268f6bc0e49d29284a225387aba7c791edd851c65a806ce8f0653d94f8a11N.exe	40
PID 2348 wrote to memory of 372	2348	08e268f6bc0e49d29284a225387aba7c791edd851c65a806ce8f0653d94f8a11N.exe	40
PID 2348 wrote to memory of 372	2348	08e268f6bc0e49d29284a225387aba7c791edd851c65a806ce8f0653d94f8a11N.exe	40
PID 1680 wrote to memory of 2832	1680	Unicorn-19994.exe	41
PID 1680 wrote to memory of 2832	1680	Unicorn-19994.exe	41
PID 1680 wrote to memory of 2832	1680	Unicorn-19994.exe	41
PID 1680 wrote to memory of 2832	1680	Unicorn-19994.exe	41
PID 2892 wrote to memory of 1032	2892	Unicorn-33729.exe	43
PID 2892 wrote to memory of 1032	2892	Unicorn-33729.exe	43
PID 2892 wrote to memory of 1032	2892	Unicorn-33729.exe	43
PID 2892 wrote to memory of 1032	2892	Unicorn-33729.exe	43
PID 2872 wrote to memory of 2904	2872	Unicorn-23524.exe	42
PID 2872 wrote to memory of 2904	2872	Unicorn-23524.exe	42
PID 2872 wrote to memory of 2904	2872	Unicorn-23524.exe	42
PID 2872 wrote to memory of 2904	2872	Unicorn-23524.exe	42
PID 2504 wrote to memory of 2040	2504	Unicorn-59395.exe	44
PID 2504 wrote to memory of 2040	2504	Unicorn-59395.exe	44
PID 2504 wrote to memory of 2040	2504	Unicorn-59395.exe	44
PID 2504 wrote to memory of 2040	2504	Unicorn-59395.exe	44
PID 1356 wrote to memory of 1208	1356	Unicorn-23934.exe	45
PID 1356 wrote to memory of 1208	1356	Unicorn-23934.exe	45
PID 1356 wrote to memory of 1208	1356	Unicorn-23934.exe	45
PID 1356 wrote to memory of 1208	1356	Unicorn-23934.exe	45
PID 1688 wrote to memory of 1336	1688	Unicorn-33865.exe	46
PID 1688 wrote to memory of 1336	1688	Unicorn-33865.exe	46
PID 1688 wrote to memory of 1336	1688	Unicorn-33865.exe	46
PID 1688 wrote to memory of 1336	1688	Unicorn-33865.exe	46

C:\Users\Admin\AppData\Local\Temp\08e268f6bc0e49d29284a225387aba7c791edd851c65a806ce8f0653d94f8a11N.exe
"C:\Users\Admin\AppData\Local\Temp\08e268f6bc0e49d29284a225387aba7c791edd851c65a806ce8f0653d94f8a11N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59395.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59395.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23934.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23934.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23524.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23524.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54655.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39253.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19876.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2164.exe
        8⤵
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13789.exe
        9⤵
        
        PID:4436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34570.exe
        9⤵
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47634.exe
        8⤵
        
        PID:3312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24192.exe
        8⤵
        
        PID:4472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20994.exe
        8⤵
        
        PID:4364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47836.exe
        7⤵
        
        PID:2492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27789.exe
        8⤵
        
        PID:3140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19911.exe
        8⤵
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29475.exe
        8⤵
        
        PID:5464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39138.exe
        7⤵
        
        PID:1732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49274.exe
        7⤵
        
        PID:3816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24893.exe
        7⤵
        
        PID:2528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7301.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23867.exe
        7⤵
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59938.exe
        7⤵
        
        PID:3780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-726.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54171.exe
        7⤵
        
        PID:5820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39309.exe
        6⤵
        
        PID:2784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27789.exe
        7⤵
        
        PID:3148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7659.exe
        7⤵
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33559.exe
        7⤵
        
        PID:5152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5999.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36524.exe
        6⤵
        
        PID:4244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28970.exe
        6⤵
        
        PID:5880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35723.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49040.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49362.exe
        7⤵
        
        PID:2424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33452.exe
        8⤵
        
        PID:3920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56529.exe
        8⤵
        
        PID:4720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe
        8⤵
        
        PID:5504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47634.exe
        7⤵
        
        PID:3384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4727.exe
        7⤵
        
        PID:4756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33559.exe
        7⤵
        
        PID:2100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58277.exe
        6⤵
        
        PID:640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37671.exe
        7⤵
        
        PID:3192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9624.exe
        7⤵
        
        PID:5852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61369.exe
        6⤵
        
        PID:3288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18621.exe
        6⤵
        
        PID:4308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4274.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1877.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32258.exe
        6⤵
        
        PID:2632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3145.exe
        7⤵
        
        PID:464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38941.exe
        7⤵
        
        PID:4076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32858.exe
        7⤵
        
        PID:4432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37529.exe
        7⤵
        
        PID:4392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3892.exe
        6⤵
        
        PID:2476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43409.exe
        6⤵
        
        PID:3968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33559.exe
        6⤵
        
        PID:5128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60773.exe
        5⤵
        
        PID:1936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-213.exe
        6⤵
        
        PID:2640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29673.exe
        6⤵
        
        PID:3944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7811.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24073.exe
        5⤵
        
        PID:4204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21339.exe
        5⤵
        
        PID:5544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55210.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55210.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5620.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7431.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38454.exe
        7⤵
        
        PID:1728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45512.exe
        8⤵
        
        PID:3516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51184.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47634.exe
        7⤵
        
        PID:3240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56529.exe
        8⤵
        
        PID:4696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43409.exe
        7⤵
        
        PID:4044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29475.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22096.exe
        6⤵
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41755.exe
        7⤵
        
        PID:3436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9874.exe
        7⤵
        
        PID:5284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61369.exe
        6⤵
        
        PID:3220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46581.exe
        6⤵
        
        PID:4560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20809.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28994.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25589.exe
        6⤵
        
        PID:4144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15489.exe
        6⤵
        
        PID:5264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14695.exe
        5⤵
        
        PID:2032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49274.exe
        5⤵
        
        PID:3828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20809.exe
        5⤵
        
        PID:5208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15826.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15826.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60955.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9948.exe
        6⤵
        
        PID:800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37671.exe
        7⤵
        
        PID:3404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9624.exe
        7⤵
        
        PID:5772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19153.exe
        6⤵
        
        PID:3856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10592.exe
        6⤵
        
        PID:4840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20809.exe
        6⤵
        
        PID:5308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39522.exe
        5⤵
        
        PID:1152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37287.exe
        6⤵
        
        PID:4228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9624.exe
        6⤵
        
        PID:5936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10985.exe
        5⤵
        
        PID:3772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10592.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45506.exe
        5⤵
        
        PID:5844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51946.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51946.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16882.exe
        5⤵
        
        PID:2292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29673.exe
        6⤵
        
        PID:3824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27693.exe
        6⤵
        
        PID:2088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47634.exe
        5⤵
        
        PID:3320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4727.exe
        5⤵
        
        PID:4748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29475.exe
        5⤵
        
        PID:5456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53836.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53836.exe
      4⤵
      PID:2440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37671.exe
        5⤵
        
        PID:3200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59542.exe
        5⤵
        
        PID:6088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42033.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42033.exe
      4⤵
      PID:3268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38446.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38446.exe
      4⤵
      PID:4596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24505.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24505.exe
      4⤵
      PID:5928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19994.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19994.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54655.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15049.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2963.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4354.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61775.exe
        8⤵
        
        PID:1668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59938.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-726.exe
        8⤵
        
        PID:4252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46195.exe
        8⤵
        
        PID:4404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32864.exe
        7⤵
        
        PID:1124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36917.exe
        7⤵
        
        PID:3840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6591.exe
        7⤵
        
        PID:4260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24893.exe
        7⤵
        
        PID:4532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25521.exe
        6⤵
        Executes dropped EXE
        
        PID:1376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4136.exe
        7⤵
        
        PID:1796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37671.exe
        8⤵
        
        PID:3236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54737.exe
        8⤵
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47634.exe
        7⤵
        
        PID:3368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4727.exe
        7⤵
        
        PID:4940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54171.exe
        7⤵
        
        PID:5812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23278.exe
        6⤵
        
        PID:1696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37671.exe
        7⤵
        
        PID:3420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1697.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37915.exe
        6⤵
        
        PID:4584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8358.exe
        6⤵
        
        PID:5116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20046.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20307.exe
        6⤵
        
        PID:1620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64100.exe
        7⤵
        
        PID:560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37671.exe
        8⤵
        
        PID:3500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9624.exe
        8⤵
        
        PID:5940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29673.exe
        7⤵
        
        PID:4020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25402.exe
        6⤵
        
        PID:2596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43409.exe
        6⤵
        
        PID:3136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29475.exe
        6⤵
        
        PID:5416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51125.exe
        5⤵
        
        PID:2688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27789.exe
        6⤵
        
        PID:3156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41755.exe
        7⤵
        
        PID:3452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6257.exe
        7⤵
        
        PID:6104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43409.exe
        6⤵
        
        PID:4112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29475.exe
        6⤵
        
        PID:5448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45003.exe
        5⤵
        
        PID:2136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40609.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8358.exe
        5⤵
        
        PID:5164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1899.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1899.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7670.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18117.exe
        6⤵
        
        PID:2684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45268.exe
        7⤵
        
        PID:2524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29673.exe
        7⤵
        
        PID:3096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe
        7⤵
        
        PID:5624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51936.exe
        6⤵
        
        PID:3028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38989.exe
        6⤵
        
        PID:4460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45506.exe
        6⤵
        
        PID:5916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50409.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4598.exe
        5⤵
        
        PID:3976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1927.exe
        5⤵
        
        PID:4736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8358.exe
        5⤵
        
        PID:2068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25660.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25660.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63617.exe
        5⤵
        
        PID:2124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37287.exe
        6⤵
        
        PID:4220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9624.exe
        6⤵
        
        PID:5912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47634.exe
        5⤵
        
        PID:3360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4727.exe
        5⤵
        
        PID:4956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54171.exe
        5⤵
        
        PID:5864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1515.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1515.exe
      4⤵
      PID:2916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47230.exe
        5⤵
        
        PID:4384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58569.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58569.exe
      4⤵
      PID:3208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21380.exe
      4⤵
      PID:4612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21339.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21339.exe
      4⤵
      PID:5392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56693.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56693.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54629.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54629.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3923.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24282.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62232.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56529.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15489.exe
        7⤵
        
        PID:5696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10986.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39325.exe
        6⤵
        
        PID:4156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29475.exe
        6⤵
        
        PID:5424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34156.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37671.exe
        6⤵
        
        PID:3492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9874.exe
        6⤵
        
        PID:5632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41525.exe
        5⤵
        
        PID:3128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33945.exe
        5⤵
        
        PID:4504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20809.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28598.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28598.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2019.exe
        5⤵
        
        PID:1980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37287.exe
        6⤵
        
        PID:4212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62787.exe
        5⤵
        
        PID:3720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4727.exe
        5⤵
        
        PID:4800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29475.exe
        5⤵
        
        PID:5472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8141.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8141.exe
      4⤵
      PID:2172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41755.exe
        5⤵
        
        PID:3488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9874.exe
        5⤵
        
        PID:5268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16850.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16850.exe
      4⤵
      PID:3764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1927.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1927.exe
      4⤵
      PID:4880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28970.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28970.exe
      4⤵
      PID:5904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5355.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5355.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3586.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3586.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24910.exe
        5⤵
        
        PID:1088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62096.exe
        5⤵
        
        PID:5084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6824.exe
        5⤵
        
        PID:5236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51936.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51936.exe
      4⤵
      PID:2400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39325.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39325.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6824.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6824.exe
      4⤵
      PID:5756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22860.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22860.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25626.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25626.exe
      4⤵
      PID:1768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45268.exe
        5⤵
        
        PID:1616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29673.exe
        5⤵
        
        PID:4092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25402.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25402.exe
      4⤵
      PID:2568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25284.exe
        5⤵
        
        PID:3896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56529.exe
        5⤵
        
        PID:4764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe
        5⤵
        
        PID:5520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43850.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43850.exe
      4⤵
      PID:3948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10592.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10592.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20809.exe
      4⤵
      PID:5248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3943.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3943.exe
    3⤵
    PID:756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48018.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48018.exe
      4⤵
      PID:2700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44032.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44032.exe
      4⤵
      PID:4356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29475.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29475.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63401.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63401.exe
    3⤵
    PID:2992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19608.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19608.exe
    3⤵
    PID:3188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64095.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64095.exe
    3⤵
    PID:5172
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64452.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64452.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35776.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35776.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37395.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37395.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55589.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19923.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3913.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25589.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46072.exe
        7⤵
        
        PID:5256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51936.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39325.exe
        6⤵
        
        PID:4104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58255.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32921.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27951.exe
        6⤵
        
        PID:2720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35625.exe
        6⤵
        
        PID:3108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5354.exe
        6⤵
        
        PID:3176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45003.exe
        5⤵
        
        PID:856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24379.exe
        6⤵
        
        PID:4548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26594.exe
        6⤵
        
        PID:4376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40609.exe
        5⤵
        
        PID:3892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8358.exe
        5⤵
        
        PID:1380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52252.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52252.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3586.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6103.exe
        6⤵
        
        PID:1736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24142.exe
        7⤵
        
        PID:752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10929.exe
        7⤵
        
        PID:4012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32858.exe
        7⤵
        
        PID:4428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37529.exe
        7⤵
        
        PID:4340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20036.exe
        6⤵
        
        PID:2516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24664.exe
        6⤵
        
        PID:4028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24192.exe
        6⤵
        
        PID:4468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20994.exe
        6⤵
        
        PID:4368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10825.exe
        5⤵
        
        PID:2340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25284.exe
        6⤵
        
        PID:3904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56529.exe
        6⤵
        
        PID:4920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15489.exe
        6⤵
        
        PID:5740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19153.exe
        5⤵
        
        PID:3848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10592.exe
        5⤵
        
        PID:4824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20809.exe
        5⤵
        
        PID:5344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29744.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29744.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29103.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59938.exe
        5⤵
        
        PID:3756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-726.exe
        5⤵
        
        PID:4268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29475.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11624.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11624.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54537.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54537.exe
      4⤵
      PID:3940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46927.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46927.exe
      4⤵
      PID:4136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38060.exe
      4⤵
      PID:2140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33865.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33865.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46653.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46653.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39912.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57063.exe
        6⤵
        
        PID:2208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29409.exe
        7⤵
        
        PID:2388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21958.exe
        8⤵
        
        PID:4520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47783.exe
        8⤵
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47634.exe
        7⤵
        
        PID:3328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4727.exe
        7⤵
        
        PID:4772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29475.exe
        7⤵
        
        PID:5440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9543.exe
        6⤵
        
        PID:1840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12455.exe
        7⤵
        
        PID:3196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56529.exe
        7⤵
        
        PID:4708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61369.exe
        6⤵
        
        PID:3304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10592.exe
        6⤵
        
        PID:4816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45506.exe
        6⤵
        
        PID:5764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16777.exe
        5⤵
        
        PID:2092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45268.exe
        6⤵
        
        PID:1908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29673.exe
        6⤵
        
        PID:4068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe
        6⤵
        
        PID:5576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39138.exe
        5⤵
        
        PID:2952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49274.exe
        5⤵
        
        PID:3740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24893.exe
        5⤵
        
        PID:920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24322.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24322.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57255.exe
        5⤵
        
        PID:3036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48018.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17171.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29475.exe
        6⤵
        
        PID:5528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61753.exe
        5⤵
        
        PID:3084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50089.exe
        5⤵
        
        PID:4324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24893.exe
        5⤵
        
        PID:5108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26620.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26620.exe
      4⤵
      PID:820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9279.exe
        5⤵
        
        PID:2408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25589.exe
        5⤵
        
        PID:4164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45003.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45003.exe
      4⤵
      PID:2236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40609.exe
      4⤵
      PID:3984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8358.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8358.exe
      4⤵
      PID:3080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15634.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15634.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19108.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19108.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13098.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41236.exe
        6⤵
        
        PID:3408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43316.exe
        6⤵
        
        PID:4912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15489.exe
        6⤵
        
        PID:5748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25402.exe
        5⤵
        
        PID:1924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43409.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6824.exe
        5⤵
        
        PID:5712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38541.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38541.exe
      4⤵
      PID:2744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55449.exe
        5⤵
        
        PID:524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17116.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56529.exe
        6⤵
        
        PID:4792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe
        6⤵
        
        PID:5536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47634.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4727.exe
        5⤵
        
        PID:4948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54171.exe
        5⤵
        
        PID:5888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61571.exe
      4⤵
      PID:2464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45268.exe
        5⤵
        
        PID:1716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29673.exe
        5⤵
        
        PID:4060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45003.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45003.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40609.exe
      4⤵
      PID:3876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8358.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8358.exe
      4⤵
      PID:4296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51707.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51707.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62299.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62299.exe
      4⤵
      PID:2380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34722.exe
        5⤵
        
        PID:2260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35097.exe
        5⤵
        
        PID:5004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24893.exe
        5⤵
        
        PID:3172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25402.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25402.exe
      4⤵
      PID:828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43409.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43409.exe
      4⤵
      PID:3960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33559.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33559.exe
      4⤵
      PID:5144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28864.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28864.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62756.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62756.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41755.exe
        5⤵
        
        PID:3460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9874.exe
        5⤵
        
        PID:5276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29673.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29673.exe
      4⤵
      PID:4084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe
      4⤵
      PID:5616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19802.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19802.exe
    3⤵
    PID:2728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41139.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41139.exe
    3⤵
    PID:3796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65346.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65346.exe
    3⤵
    PID:5228
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33729.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33729.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54655.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54655.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38293.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38293.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16176.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1038.exe
        6⤵
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2164.exe
        7⤵
        
        PID:2644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41755.exe
        8⤵
        
        PID:3476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9874.exe
        8⤵
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47634.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4727.exe
        7⤵
        
        PID:4784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29475.exe
        7⤵
        
        PID:5432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47836.exe
        6⤵
        
        PID:2868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37671.exe
        7⤵
        
        PID:3416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9874.exe
        7⤵
        
        PID:5360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61369.exe
        6⤵
        
        PID:3256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10592.exe
        6⤵
        
        PID:4964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45506.exe
        6⤵
        
        PID:5804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8884.exe
        5⤵
        
        PID:2764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3337.exe
        6⤵
        
        PID:352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9319.exe
        7⤵
        
        PID:5320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25589.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15489.exe
        6⤵
        
        PID:5688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47176.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49274.exe
        5⤵
        
        PID:4052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24893.exe
        5⤵
        
        PID:5184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29174.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29174.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47836.exe
        5⤵
        
        PID:2740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-203.exe
        6⤵
        
        PID:3180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41755.exe
        7⤵
        
        PID:3468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9874.exe
        7⤵
        
        PID:5372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29673.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15489.exe
        6⤵
        
        PID:5760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61369.exe
        5⤵
        
        PID:3296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10592.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20809.exe
        5⤵
        
        PID:5336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64228.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64228.exe
      4⤵
      PID:1804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42782.exe
        5⤵
        
        PID:3804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63463.exe
        5⤵
        
        PID:4236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20994.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45003.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45003.exe
      4⤵
      PID:1584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40609.exe
      4⤵
      PID:3916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8358.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8358.exe
      4⤵
      PID:3284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34763.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34763.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16476.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16476.exe
      4⤵
      PID:2864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42528.exe
        5⤵
        
        PID:544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29673.exe
        5⤵
        
        PID:4036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe
        5⤵
        
        PID:5584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39138.exe
      4⤵
      PID:1596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49274.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49274.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24893.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24893.exe
      4⤵
      PID:2692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1301.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1301.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38454.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38454.exe
      4⤵
      PID:944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62232.exe
        5⤵
        
        PID:3992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56529.exe
        5⤵
        
        PID:4896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48306.exe
        5⤵
        
        PID:5948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47634.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47634.exe
      4⤵
      PID:3376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27287.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27287.exe
      4⤵
      PID:4312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20809.exe
      4⤵
      PID:5676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41697.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41697.exe
    3⤵
    PID:1704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56529.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56529.exe
      4⤵
      PID:4972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15489.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15489.exe
      4⤵
      PID:5728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58569.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58569.exe
    3⤵
    PID:3248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56977.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56977.exe
    3⤵
    PID:3432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28589.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28589.exe
    3⤵
    PID:5776
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54390.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54390.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21957.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21957.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19923.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19923.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53638.exe
        5⤵
        
        PID:1612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45268.exe
        6⤵
        
        PID:2268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29673.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27693.exe
        6⤵
        
        PID:4540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25402.exe
        5⤵
        
        PID:664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43409.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33559.exe
        5⤵
        
        PID:5136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62553.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62553.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6264.exe
        5⤵
        
        PID:1744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25589.exe
        5⤵
        
        PID:4180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15489.exe
        5⤵
        
        PID:5720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39138.exe
      4⤵
      PID:1984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49274.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49274.exe
      4⤵
      PID:3104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20809.exe
      4⤵
      PID:5352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41089.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41089.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37162.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37162.exe
      4⤵
      PID:680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25589.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25589.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15489.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15489.exe
      4⤵
      PID:5704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39138.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39138.exe
    3⤵
    PID:2636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45190.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45190.exe
    3⤵
    PID:3512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24893.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24893.exe
    3⤵
    PID:4516
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30322.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30322.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39419.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39419.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6248.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6248.exe
      4⤵
      PID:2612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41755.exe
        5⤵
        
        PID:3448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9874.exe
        5⤵
        
        PID:5292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47634.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47634.exe
      4⤵
      PID:3336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4727.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4727.exe
      4⤵
      PID:4808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29475.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29475.exe
      4⤵
      PID:5496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47452.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47452.exe
    3⤵
    PID:2004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56529.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56529.exe
      4⤵
      PID:4684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe
      4⤵
      PID:5400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61369.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61369.exe
    3⤵
    PID:3276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10592.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10592.exe
    3⤵
    PID:4860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20809.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20809.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5240
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59994.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59994.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47987.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47987.exe
    3⤵
    PID:2324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41755.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41755.exe
      4⤵
      PID:3168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9874.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9874.exe
      4⤵
      PID:5300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5418.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5418.exe
    3⤵
    PID:3864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4727.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4727.exe
    3⤵
    PID:4932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29475.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29475.exe
    3⤵
    PID:5568
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64667.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64667.exe
  2⤵
  PID:1964
- C:\Users\Admin\AppData\Local\Temp\Unicorn-58040.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-58040.exe
  2⤵
  PID:3800
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37127.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37127.exe
  2⤵
  PID:4128
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15394.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15394.exe
  2⤵
  PID:3040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-19994.exe

Filesize
468KB

MD5
775f05e8ead9c11c48b2f0f2b0ee1054

SHA1
11654731e136c549273e8c4903d5e02d59683897

SHA256
46cd0960eebf301d3251632acf0e253ef09d9081ba0cfde87845bec32ed8c8a1

SHA512
69a513fe70b324a4795646f5e28cf2bc6335ff76c236395036f884dd0ca3a5a3f167b2d7f47c8cec7945467cbfef83af13f51c24b58d97f2c865153d9ae71994

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33865.exe

Filesize
468KB

MD5
5d5731f9fcc5c0b67f3ba6186e995333

SHA1
4c4d97f75028c93626470a6aa4aa8fd5580889eb

SHA256
6fd05d49c7a49899d8b644667ce62c1201d80baf974c34f820634c3b3296da49

SHA512
a28c543ce34dc4d48ce59dd15c348e591f85090b13d93247c771fb59a437019a6e3da0a1fc3e71ad22a0e2750dd88e09bd53ede8e97122fad9d4752af80f640b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37395.exe

Filesize
468KB

MD5
2da8050ea9dbeaf3c8363e438b0f75c5

SHA1
93c1f0df40aedbb4258c0d97b254b5bac331d5ad

SHA256
1340446c9057b0063139b8299ffe3ed80bb521a90c84064acf090f34c18113cd

SHA512
20f71429a23e7e1d32f6167e9f9ca6d944e7ecbd3b5fb548dec007e855df045fa2a871411119eac5d2a1641c7d9f1f9f93671bbaf3618345e94313115d3a8ab5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41755.exe

Filesize
468KB

MD5
9a1689866b2648ba788d17ecc2231b76

SHA1
a87e4af7fe82e2318cec645f984e1444e2b5d3d0

SHA256
974d8d310b207bebd57a0fc0a004b89c70dd525ce1e4fd79f4646d4e61acb710

SHA512
326c25092c49c569fb7f05f39438bd8d9d103af0222d031ba66c00679094aed9001e1d51c272bc4c53973cd567509559992cf5ad0243375a96656c0fce139e6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47783.exe

Filesize
468KB

MD5
6b89c9473a5887c04ae18c08bd740eb4

SHA1
bc2a2089007c978f47cb26c1d78ab2075c01ef7e

SHA256
a231ae42f29ef6241d07f6a3f83f517c69bca7e2e5c8646a3ac416c216ee78ac

SHA512
5dba1d213204d1e5769cfb3542b91ea118a5d37b9b3ec50d775fbba81053bbdfd498a4f4caa318ba858699ef47722045c4229430013744642c27ffdd0614d932

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54390.exe

Filesize
468KB

MD5
09ff46af8c143afda065b7f5906a4ff8

SHA1
82135a1ab31a3470cd303250a2ed213c237a0e31

SHA256
06d61dc42cbccda885748a08ec8c86baa14bc07dff96422d5dd5eda4a6fd887c

SHA512
467602672cb3c8d5e6980d1f38b826fae4937b400a19ce7af479cf59d2204ed3d19050f627456cf4e418d8b525ca709afd62f7daec01ac5afef99319911000b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55210.exe

Filesize
468KB

MD5
a4330442207b1c09e93492e6a3b1bfdf

SHA1
4535c204edc66d9aa9d3441c53c8a35863f9a6dc

SHA256
1fca1ce6652aab69714765dd713c807b82ae4bdc84c4f6ec29bde742899c470b

SHA512
4f8a0de681578828fca6dcddfb932f00055bf91c77869149ced092494964fc0d8951ecab2724728555090131369f9866344d5c6aa8fdc073028d2636341e73d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5620.exe

Filesize
468KB

MD5
b7d1b3a5ac9b6f34bf147b905b65e955

SHA1
c99c10d87f65e3247310fd7701dc43b313e027da

SHA256
df84403f3568d17f9716fdfd5234ee6cf23d80724c4420f7b02780a18dc92e67

SHA512
22809c5d6940e593a1766dccce1b87445e23394acd9c3ab95818db80ceb7428e3baa2bacefe390e634a636e5a900d79d9c6544fcfde49586e49ffddf902fc0ee

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-15049.exe

Filesize
468KB

MD5
c1ecbd4ae3cc6c31ed9fef54cebf50ae

SHA1
3f7fa0fc6275aa6ace979122f438d821534cd266

SHA256
7a661a8575d992dc26a2fc5800784cd4dd8be1d25154383938e384f83b6d9c11

SHA512
3db451d8c6941d088d80c364c8606d72e0785c67dc048c8919d805eaff70005e9ce21be7c02e38db1974c942f6b5daa9238c5ed941b84f8fa94808e95a31bf7b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-15634.exe

Filesize
468KB

MD5
f54dc9658ef0520f0a6d6cc277e26d2d

SHA1
267137b72b2da7e2f69389ddd09d5f2e485005a4

SHA256
3523d1ed4b5029684db2092243070e951db1544c491a60a499b943411160f4de

SHA512
5450e1502855a57f2bc71fe2a70125dbdea95d88a3909e22d90988f093fe5cc0e34acca8a0421782d0330add2ee69bb3929426183b9ff710527305133ff2df6e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-1899.exe

Filesize
468KB

MD5
8f5b1e2673f78790df2ae5b6bb176f27

SHA1
31ce524bb71afb9d5accf454f4d58816df3d5276

SHA256
1e3fe964f05c64b5a09090358efd2842f9150acb964c9dcd2eb9141420e00abf

SHA512
8adec940159ac9c320c9de2ccf95d2252f27bcc44a6bf305515b6a1b62941d1e9bacd3ee7895a58acc52c6d8e54f194d7d19a79552291a7d0d01f0963e13dc70

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-23524.exe

Filesize
468KB

MD5
65c3da88b3aa4fe71796dccce9b82d64

SHA1
6622c1dc71745b83d0e3067af463a936178b8d1e

SHA256
6e536652d893636659dc540c3dd201c57dc36e0d50ea65d372eaa978cea714b2

SHA512
ff8cb4dcd0974736075108ceca1320f83bb8842c19964fbd295f8e1561cb096891bf8e85b2df81f8174dca68e879f1050241268188744e7de07a05bc0fcc91c3

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-23934.exe

Filesize
468KB

MD5
891bffd47ad62c4d18ba5ce3020e9e8a

SHA1
f527ada6e003679b87bbd000081dc97cd2c3a0d4

SHA256
e6f190fcd5c3956ab2e0b1fae008af685bc81833f53ef6c053c377bb34ccfc48

SHA512
c4193f2e61adf90c8b7b2dccb4100cf1a7dae2417283d24380a2cc74932393280bc58506e6e0cd63b39f9320fbaab08fa56f70bba0c3f5ff3339944dacf6c60e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-33729.exe

Filesize
468KB

MD5
9350eca6159a1f000eb138f27f5d4470

SHA1
1b368f8407d77da182d9f98369e65c2b66fdc8f1

SHA256
76bdd63c7b94a177aeea95c741781c10ec073beef771f88e5436cc5e650de191

SHA512
5b9b78864afd7aad0b3f76b634d672cf39a26fc335f31ba6849bc05b7c79d34e2594d858d392df87871ef6e44fb67de6c9f6478417ba772eafac0aca16b1972c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-35776.exe

Filesize
468KB

MD5
675b26e8b8c3728fbe5199e98cfa4f58

SHA1
042c6e839ebf61ed5ecaefa1d5d91781a6803afc

SHA256
d83ba415ae5a0bcec74095d630452bd0c42df2dc90d04cf8d16435e758fe4c08

SHA512
3f061079f25a99879cd0c7589005cfc402b54fc75d6ca22f9b59871927e5f3d34afece192eddc1ceb57714b2cd95bd6da9aea2d0f06a77deb158d4ca24c74c9e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-46653.exe

Filesize
468KB

MD5
043c51cd1bc66d11e0776805d034c2b1

SHA1
3173a7a9ad087e077a43218632838b7959f711bb

SHA256
c8c6dd42f8e00d094282b333564c894e1d03ed411952bab9b78a60b2dc522d81

SHA512
204dad4af8fcbc35a915e7ff6fe4e7918c099e203c91bef9706a53f685d948fcc2c539fbbc299bfc2e0ea7f1fd2d8d302531972e3e181b7433e2fdac2245e778

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-54655.exe

Filesize
468KB

MD5
b70870ce2d5c9dbb17f9c9f52b18c1cf

SHA1
d913ddece2eddf2378f123bacf9bd7e85a9f4a8d

SHA256
8ded436ecb0d4fa97b283375ef3f483ff9b9f3c704f1de52e25f7db398e6a4cc

SHA512
03e4e43ef1948167cf283adf4a195e718923305e0a91b8c910921ba2c1d41a323e5387ba77c9ddfc8c3f28df6f84f55b48be0f08c9692460e9ad4803250b1877

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-56693.exe

Filesize
468KB

MD5
c74205499760bd45a51bf007de19b399

SHA1
d2a244a63853a646114cdf66c3b07a293594bfc5

SHA256
2c368376d203ce678d5814e37022079d3874f4707148320e5c32c4caa8733347

SHA512
ad90bd0d97171c73d7f1f4d4b48d796c0f312bc6523838be8d9b039e382f51ef62e443278ec57a9e758e73d50d464f4885d38f5f4f27238c8a7833212ea0146a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-59395.exe

Filesize
468KB

MD5
12ca65849536faf9e04d9b2a8fcdd84b

SHA1
f141ce215cad2eacdf798f8072bbd28a9af29165

SHA256
234faff726939f8bb77fa1aa67296f69f4ac35930b53009115e8c6e9e6ce465e

SHA512
b4e80543d47cbfbca027f791a3b1888c79cac2cfad6e101f2fb83d2900f976d053e04fb40c9a948ed6ad33479a9f4da7c9a7890727004b4ad24f5851e2609e0f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-64452.exe

Filesize
468KB

MD5
860e238c2ebad286f90ec34e839952f8

SHA1
fa4e6bc2f72ff4fbb5e181358d071e6e07b8f3e9

SHA256
6e29db18079f88280d3a3b771ae06f58c67a60c01e9fb37996930f99a652b262

SHA512
1870832234d6b7ba8af4ac46bc5510bd3101737677c8e90c50509de739f00ee611081e1388575a3d534793dcb68e885f3d3052493862856bff382c62c71bef78

Download Submit