33fd5bcdc39175e72de8d8e721436acdd56755806db4d7cf8c2fdc7ef388f608

Analysis

max time kernel
116s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10/10/2024, 01:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

33fd5bcdc39175e72de8d8e721436acdd56755806db4d7cf8c2fdc7ef388f608N.exe
Size

468KB
MD5

1db0716d7190cc14bc591c99bdde2790
SHA1

ed53dd0f60b5c0bb3b34f1bbe216d92c42b3e796
SHA256

33fd5bcdc39175e72de8d8e721436acdd56755806db4d7cf8c2fdc7ef388f608
SHA512

8336006d5703650fe819ec9344e94f84fb723ec55c668979075191496314fc54824642544dba5e26eb4acda423988572d712d2d900d03dff82a6dad6390dd418
SSDEEP

3072:4belogxaIU57tbYZPzcfmbfD/n2znsIH/QmyeQVqZ/5Kkti3uxulj:4b4oCc7tCP4fmbfba1J/5DI3ux

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
396	Unicorn-60617.exe
2840	Unicorn-11663.exe
2920	Unicorn-12659.exe
2820	Unicorn-33143.exe
2972	Unicorn-45950.exe
2640	Unicorn-16724.exe
2408	Unicorn-60479.exe
1732	Unicorn-24166.exe
2380	Unicorn-11407.exe
2728	Unicorn-49062.exe
1832	Unicorn-21822.exe
2864	Unicorn-28507.exe
1684	Unicorn-22376.exe
2868	Unicorn-28507.exe
1064	Unicorn-61490.exe
1792	Unicorn-1548.exe
2276	Unicorn-44454.exe
2388	Unicorn-36956.exe
2160	Unicorn-2975.exe
2156	Unicorn-22649.exe
1312	Unicorn-59161.exe
1452	Unicorn-39487.exe
2300	Unicorn-59929.exe
1524	Unicorn-24688.exe
756	Unicorn-24953.exe
2320	Unicorn-16022.exe
1824	Unicorn-14620.exe
1680	Unicorn-34486.exe
2012	Unicorn-62372.exe
2324	Unicorn-2965.exe
1540	Unicorn-35865.exe
2120	Unicorn-17076.exe
1608	Unicorn-1050.exe
2468	Unicorn-22862.exe
1720	Unicorn-8091.exe
2304	Unicorn-26915.exe
2784	Unicorn-14374.exe
2912	Unicorn-40794.exe
2080	Unicorn-45267.exe
2800	Unicorn-48111.exe
2672	Unicorn-42569.exe
2652	Unicorn-22703.exe
2460	Unicorn-16537.exe
108	Unicorn-7400.exe
436	Unicorn-61821.exe
2056	Unicorn-11816.exe
2548	Unicorn-62854.exe
1700	Unicorn-51074.exe
1636	Unicorn-43748.exe
2996	Unicorn-63259.exe
2464	Unicorn-472.exe
3044	Unicorn-60409.exe
284	Unicorn-20338.exe
1760	Unicorn-17842.exe
3056	Unicorn-33612.exe
2340	Unicorn-43410.exe
2220	Unicorn-19626.exe
2164	Unicorn-6627.exe
1168	Unicorn-5319.exe
1644	Unicorn-23073.exe
696	Unicorn-7229.exe
1924	Unicorn-26009.exe
1020	Unicorn-26009.exe
1944	Unicorn-46590.exe

Loads dropped DLL 64 IoCs

pid	Process
2104	33fd5bcdc39175e72de8d8e721436acdd56755806db4d7cf8c2fdc7ef388f608N.exe
2104	33fd5bcdc39175e72de8d8e721436acdd56755806db4d7cf8c2fdc7ef388f608N.exe
396	Unicorn-60617.exe
2104	33fd5bcdc39175e72de8d8e721436acdd56755806db4d7cf8c2fdc7ef388f608N.exe
396	Unicorn-60617.exe
2104	33fd5bcdc39175e72de8d8e721436acdd56755806db4d7cf8c2fdc7ef388f608N.exe
2840	Unicorn-11663.exe
396	Unicorn-60617.exe
2840	Unicorn-11663.exe
396	Unicorn-60617.exe
2920	Unicorn-12659.exe
2920	Unicorn-12659.exe
2104	33fd5bcdc39175e72de8d8e721436acdd56755806db4d7cf8c2fdc7ef388f608N.exe
2104	33fd5bcdc39175e72de8d8e721436acdd56755806db4d7cf8c2fdc7ef388f608N.exe
2820	Unicorn-33143.exe
2820	Unicorn-33143.exe
2840	Unicorn-11663.exe
2840	Unicorn-11663.exe
2640	Unicorn-16724.exe
2640	Unicorn-16724.exe
2920	Unicorn-12659.exe
2920	Unicorn-12659.exe
396	Unicorn-60617.exe
2408	Unicorn-60479.exe
2972	Unicorn-45950.exe
2408	Unicorn-60479.exe
2972	Unicorn-45950.exe
396	Unicorn-60617.exe
2104	33fd5bcdc39175e72de8d8e721436acdd56755806db4d7cf8c2fdc7ef388f608N.exe
2104	33fd5bcdc39175e72de8d8e721436acdd56755806db4d7cf8c2fdc7ef388f608N.exe
1732	Unicorn-24166.exe
1732	Unicorn-24166.exe
2820	Unicorn-33143.exe
2820	Unicorn-33143.exe
2868	Unicorn-28507.exe
2868	Unicorn-28507.exe
2408	Unicorn-60479.exe
2408	Unicorn-60479.exe
2864	Unicorn-28507.exe
1064	Unicorn-61490.exe
2864	Unicorn-28507.exe
1064	Unicorn-61490.exe
2972	Unicorn-45950.exe
2972	Unicorn-45950.exe
1684	Unicorn-22376.exe
1684	Unicorn-22376.exe
396	Unicorn-60617.exe
2728	Unicorn-49062.exe
2104	33fd5bcdc39175e72de8d8e721436acdd56755806db4d7cf8c2fdc7ef388f608N.exe
396	Unicorn-60617.exe
2728	Unicorn-49062.exe
2104	33fd5bcdc39175e72de8d8e721436acdd56755806db4d7cf8c2fdc7ef388f608N.exe
2640	Unicorn-16724.exe
1832	Unicorn-21822.exe
2640	Unicorn-16724.exe
1832	Unicorn-21822.exe
2920	Unicorn-12659.exe
2920	Unicorn-12659.exe
2380	Unicorn-11407.exe
2380	Unicorn-11407.exe
2840	Unicorn-11663.exe
2840	Unicorn-11663.exe
1792	Unicorn-1548.exe
1792	Unicorn-1548.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17261.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30776.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60667.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35428.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36016.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45666.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62372.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36305.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35896.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25575.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39890.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7139.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41356.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27172.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2965.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28324.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34225.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54875.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25329.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53082.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64382.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17842.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28544.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41752.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23127.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14335.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54512.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28507.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47376.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5635.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47824.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5510.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38202.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36016.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42258.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15953.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59582.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5662.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58997.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40371.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56202.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58739.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16537.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52322.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59582.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34024.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21488.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48930.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39487.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42569.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11065.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27729.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-292.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26823.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1660.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14620.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21863.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40331.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-188.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4526.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48866.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19626.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58311.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2104	33fd5bcdc39175e72de8d8e721436acdd56755806db4d7cf8c2fdc7ef388f608N.exe
396	Unicorn-60617.exe
2840	Unicorn-11663.exe
2920	Unicorn-12659.exe
2820	Unicorn-33143.exe
2640	Unicorn-16724.exe
2972	Unicorn-45950.exe
2408	Unicorn-60479.exe
1732	Unicorn-24166.exe
2380	Unicorn-11407.exe
1832	Unicorn-21822.exe
2728	Unicorn-49062.exe
2864	Unicorn-28507.exe
2868	Unicorn-28507.exe
1684	Unicorn-22376.exe
1064	Unicorn-61490.exe
1792	Unicorn-1548.exe
2276	Unicorn-44454.exe
2388	Unicorn-36956.exe
2156	Unicorn-22649.exe
1452	Unicorn-39487.exe
2300	Unicorn-59929.exe
1312	Unicorn-59161.exe
2160	Unicorn-2975.exe
1524	Unicorn-24688.exe
2012	Unicorn-62372.exe
2324	Unicorn-2965.exe
1680	Unicorn-34486.exe
2320	Unicorn-16022.exe
1824	Unicorn-14620.exe
756	Unicorn-24953.exe
1540	Unicorn-35865.exe
2120	Unicorn-17076.exe
1608	Unicorn-1050.exe
2468	Unicorn-22862.exe
1720	Unicorn-8091.exe
2304	Unicorn-26915.exe
2784	Unicorn-14374.exe
2912	Unicorn-40794.exe
2080	Unicorn-45267.exe
2800	Unicorn-48111.exe
2672	Unicorn-42569.exe
2652	Unicorn-22703.exe
108	Unicorn-7400.exe
436	Unicorn-61821.exe
2460	Unicorn-16537.exe
2056	Unicorn-11816.exe
2548	Unicorn-62854.exe
1700	Unicorn-51074.exe
1636	Unicorn-43748.exe
2996	Unicorn-63259.exe
3044	Unicorn-60409.exe
2464	Unicorn-472.exe
284	Unicorn-20338.exe
1760	Unicorn-17842.exe
3056	Unicorn-33612.exe
2340	Unicorn-43410.exe
2164	Unicorn-6627.exe
2220	Unicorn-19626.exe
1644	Unicorn-23073.exe
1168	Unicorn-5319.exe
696	Unicorn-7229.exe
1924	Unicorn-26009.exe
1020	Unicorn-26009.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 396	2104	33fd5bcdc39175e72de8d8e721436acdd56755806db4d7cf8c2fdc7ef388f608N.exe	29
PID 2104 wrote to memory of 396	2104	33fd5bcdc39175e72de8d8e721436acdd56755806db4d7cf8c2fdc7ef388f608N.exe	29
PID 2104 wrote to memory of 396	2104	33fd5bcdc39175e72de8d8e721436acdd56755806db4d7cf8c2fdc7ef388f608N.exe	29
PID 2104 wrote to memory of 396	2104	33fd5bcdc39175e72de8d8e721436acdd56755806db4d7cf8c2fdc7ef388f608N.exe	29
PID 396 wrote to memory of 2840	396	Unicorn-60617.exe	30
PID 396 wrote to memory of 2840	396	Unicorn-60617.exe	30
PID 396 wrote to memory of 2840	396	Unicorn-60617.exe	30
PID 396 wrote to memory of 2840	396	Unicorn-60617.exe	30
PID 2104 wrote to memory of 2920	2104	33fd5bcdc39175e72de8d8e721436acdd56755806db4d7cf8c2fdc7ef388f608N.exe	31
PID 2104 wrote to memory of 2920	2104	33fd5bcdc39175e72de8d8e721436acdd56755806db4d7cf8c2fdc7ef388f608N.exe	31
PID 2104 wrote to memory of 2920	2104	33fd5bcdc39175e72de8d8e721436acdd56755806db4d7cf8c2fdc7ef388f608N.exe	31
PID 2104 wrote to memory of 2920	2104	33fd5bcdc39175e72de8d8e721436acdd56755806db4d7cf8c2fdc7ef388f608N.exe	31
PID 2840 wrote to memory of 2820	2840	Unicorn-11663.exe	32
PID 2840 wrote to memory of 2820	2840	Unicorn-11663.exe	32
PID 2840 wrote to memory of 2820	2840	Unicorn-11663.exe	32
PID 2840 wrote to memory of 2820	2840	Unicorn-11663.exe	32
PID 396 wrote to memory of 2972	396	Unicorn-60617.exe	33
PID 396 wrote to memory of 2972	396	Unicorn-60617.exe	33
PID 396 wrote to memory of 2972	396	Unicorn-60617.exe	33
PID 396 wrote to memory of 2972	396	Unicorn-60617.exe	33
PID 2920 wrote to memory of 2640	2920	Unicorn-12659.exe	34
PID 2920 wrote to memory of 2640	2920	Unicorn-12659.exe	34
PID 2920 wrote to memory of 2640	2920	Unicorn-12659.exe	34
PID 2920 wrote to memory of 2640	2920	Unicorn-12659.exe	34
PID 2104 wrote to memory of 2408	2104	33fd5bcdc39175e72de8d8e721436acdd56755806db4d7cf8c2fdc7ef388f608N.exe	35
PID 2104 wrote to memory of 2408	2104	33fd5bcdc39175e72de8d8e721436acdd56755806db4d7cf8c2fdc7ef388f608N.exe	35
PID 2104 wrote to memory of 2408	2104	33fd5bcdc39175e72de8d8e721436acdd56755806db4d7cf8c2fdc7ef388f608N.exe	35
PID 2104 wrote to memory of 2408	2104	33fd5bcdc39175e72de8d8e721436acdd56755806db4d7cf8c2fdc7ef388f608N.exe	35
PID 2820 wrote to memory of 1732	2820	Unicorn-33143.exe	36
PID 2820 wrote to memory of 1732	2820	Unicorn-33143.exe	36
PID 2820 wrote to memory of 1732	2820	Unicorn-33143.exe	36
PID 2820 wrote to memory of 1732	2820	Unicorn-33143.exe	36
PID 2840 wrote to memory of 2380	2840	Unicorn-11663.exe	37
PID 2840 wrote to memory of 2380	2840	Unicorn-11663.exe	37
PID 2840 wrote to memory of 2380	2840	Unicorn-11663.exe	37
PID 2840 wrote to memory of 2380	2840	Unicorn-11663.exe	37
PID 2640 wrote to memory of 2728	2640	Unicorn-16724.exe	38
PID 2640 wrote to memory of 2728	2640	Unicorn-16724.exe	38
PID 2640 wrote to memory of 2728	2640	Unicorn-16724.exe	38
PID 2640 wrote to memory of 2728	2640	Unicorn-16724.exe	38
PID 2920 wrote to memory of 1832	2920	Unicorn-12659.exe	39
PID 2920 wrote to memory of 1832	2920	Unicorn-12659.exe	39
PID 2920 wrote to memory of 1832	2920	Unicorn-12659.exe	39
PID 2920 wrote to memory of 1832	2920	Unicorn-12659.exe	39
PID 2408 wrote to memory of 2868	2408	Unicorn-60479.exe	41
PID 2408 wrote to memory of 2868	2408	Unicorn-60479.exe	41
PID 2408 wrote to memory of 2868	2408	Unicorn-60479.exe	41
PID 2408 wrote to memory of 2868	2408	Unicorn-60479.exe	41
PID 2972 wrote to memory of 2864	2972	Unicorn-45950.exe	42
PID 2972 wrote to memory of 2864	2972	Unicorn-45950.exe	42
PID 2972 wrote to memory of 2864	2972	Unicorn-45950.exe	42
PID 2972 wrote to memory of 2864	2972	Unicorn-45950.exe	42
PID 396 wrote to memory of 1684	396	Unicorn-60617.exe	40
PID 396 wrote to memory of 1684	396	Unicorn-60617.exe	40
PID 396 wrote to memory of 1684	396	Unicorn-60617.exe	40
PID 396 wrote to memory of 1684	396	Unicorn-60617.exe	40
PID 2104 wrote to memory of 1064	2104	33fd5bcdc39175e72de8d8e721436acdd56755806db4d7cf8c2fdc7ef388f608N.exe	43
PID 2104 wrote to memory of 1064	2104	33fd5bcdc39175e72de8d8e721436acdd56755806db4d7cf8c2fdc7ef388f608N.exe	43
PID 2104 wrote to memory of 1064	2104	33fd5bcdc39175e72de8d8e721436acdd56755806db4d7cf8c2fdc7ef388f608N.exe	43
PID 2104 wrote to memory of 1064	2104	33fd5bcdc39175e72de8d8e721436acdd56755806db4d7cf8c2fdc7ef388f608N.exe	43
PID 1732 wrote to memory of 1792	1732	Unicorn-24166.exe	44
PID 1732 wrote to memory of 1792	1732	Unicorn-24166.exe	44
PID 1732 wrote to memory of 1792	1732	Unicorn-24166.exe	44
PID 1732 wrote to memory of 1792	1732	Unicorn-24166.exe	44

C:\Users\Admin\AppData\Local\Temp\33fd5bcdc39175e72de8d8e721436acdd56755806db4d7cf8c2fdc7ef388f608N.exe
"C:\Users\Admin\AppData\Local\Temp\33fd5bcdc39175e72de8d8e721436acdd56755806db4d7cf8c2fdc7ef388f608N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60617.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60617.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11663.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11663.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33143.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33143.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24166.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1548.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17076.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43410.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36560.exe
        9⤵
        
        PID:3724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38662.exe
        9⤵
        
        PID:3676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4526.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:4160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61938.exe
        8⤵
        
        PID:2364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31124.exe
        8⤵
        
        PID:2680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38202.exe
        8⤵
        
        PID:3248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62507.exe
        8⤵
        
        PID:3856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36016.exe
        8⤵
        
        PID:4384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19626.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13910.exe
        8⤵
        
        PID:2704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17389.exe
        8⤵
        
        PID:1820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17261.exe
        8⤵
        
        PID:4000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5635.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33200.exe
        8⤵
        
        PID:4632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62836.exe
        7⤵
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8470.exe
        7⤵
        
        PID:3588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44779.exe
        7⤵
        
        PID:1896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46740.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1050.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36305.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12189.exe
        8⤵
        
        PID:2068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27474.exe
        8⤵
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34024.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19892.exe
        8⤵
        
        PID:3460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48400.exe
        8⤵
        
        PID:5036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7780.exe
        7⤵
        
        PID:2452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36990.exe
        7⤵
        
        PID:2060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43601.exe
        7⤵
        
        PID:4016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43725.exe
        7⤵
        
        PID:4996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46590.exe
        6⤵
        Executes dropped EXE
        
        PID:1944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26305.exe
        7⤵
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47926.exe
        7⤵
        
        PID:3024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41752.exe
        7⤵
        
        PID:3720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19892.exe
        7⤵
        
        PID:3404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47824.exe
        7⤵
        
        PID:4540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46133.exe
        6⤵
        
        PID:1004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58861.exe
        6⤵
        
        PID:456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22416.exe
        6⤵
        
        PID:3692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11757.exe
        6⤵
        
        PID:848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26823.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44454.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22862.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23073.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28544.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47373.exe
        8⤵
        
        PID:3624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4635.exe
        8⤵
        
        PID:3924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46210.exe
        8⤵
        
        PID:4824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59582.exe
        7⤵
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31124.exe
        7⤵
        
        PID:3108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38202.exe
        7⤵
        
        PID:3316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62507.exe
        7⤵
        
        PID:3816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36016.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26009.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16831.exe
        7⤵
        
        PID:1108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44365.exe
        7⤵
        
        PID:4036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54558.exe
        7⤵
        
        PID:3840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3287.exe
        7⤵
        
        PID:4820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25258.exe
        6⤵
        
        PID:1288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-188.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53238.exe
        6⤵
        
        PID:3640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27172.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25329.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8091.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50648.exe
        6⤵
        
        PID:2808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27474.exe
        6⤵
        
        PID:1752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23127.exe
        6⤵
        
        PID:3396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53982.exe
        6⤵
        
        PID:4372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50132.exe
        6⤵
        
        PID:5052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1867.exe
        5⤵
        
        PID:1460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58311.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14689.exe
        5⤵
        
        PID:3520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59782.exe
        5⤵
        
        PID:4624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11407.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11407.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2965.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11816.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12421.exe
        7⤵
        
        PID:620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64800.exe
        7⤵
        
        PID:3384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55663.exe
        7⤵
        
        PID:3708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35896.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21920.exe
        7⤵
        
        PID:4780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59582.exe
        6⤵
        
        PID:2088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31124.exe
        6⤵
        
        PID:3140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38202.exe
        6⤵
        
        PID:3236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47048.exe
        6⤵
        
        PID:4072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26591.exe
        6⤵
        
        PID:4136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51074.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50144.exe
        6⤵
        
        PID:3168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30115.exe
        6⤵
        
        PID:844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15953.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7780.exe
        5⤵
        
        PID:2836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36990.exe
        5⤵
        
        PID:804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43601.exe
        5⤵
        
        PID:4012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29911.exe
        5⤵
        
        PID:4980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35865.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7400.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63796.exe
        6⤵
        
        PID:2744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17389.exe
        6⤵
        
        PID:1148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32336.exe
        6⤵
        
        PID:3184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5635.exe
        6⤵
        
        PID:2280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33200.exe
        6⤵
        
        PID:4644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59582.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31124.exe
        5⤵
        
        PID:3148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13759.exe
        5⤵
        
        PID:3176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29674.exe
        5⤵
        
        PID:4864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61821.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61821.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59096.exe
        5⤵
        
        PID:2052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29830.exe
        5⤵
        
        PID:940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41752.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19892.exe
        5⤵
        
        PID:3616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48400.exe
        5⤵
        
        PID:5024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58739.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58739.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41775.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41775.exe
      4⤵
      PID:3036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31755.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31755.exe
      4⤵
      PID:3532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55763.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55763.exe
      4⤵
      PID:2708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21488.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45950.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45950.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28507.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28507.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22649.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63259.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14334.exe
        7⤵
        
        PID:1264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44365.exe
        7⤵
        
        PID:4028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20726.exe
        7⤵
        
        PID:3684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54875.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59582.exe
        6⤵
        
        PID:1444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31124.exe
        6⤵
        
        PID:3100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38202.exe
        6⤵
        
        PID:3280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62507.exe
        6⤵
        
        PID:4004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24617.exe
        6⤵
        
        PID:5108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-472.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3530.exe
        6⤵
        
        PID:3156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39192.exe
        6⤵
        
        PID:4412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7780.exe
        5⤵
        
        PID:2772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36990.exe
        5⤵
        
        PID:1084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29536.exe
        5⤵
        
        PID:3220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30512.exe
        5⤵
        
        PID:3900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53082.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39487.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39487.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42569.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44598.exe
        6⤵
        
        PID:3324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1222.exe
        6⤵
        
        PID:3604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39070.exe
        6⤵
        
        PID:4296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26817.exe
        6⤵
        
        PID:4932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59582.exe
        5⤵
        
        PID:2096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31124.exe
        5⤵
        
        PID:780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38202.exe
        5⤵
        
        PID:3300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62507.exe
        5⤵
        
        PID:4048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10363.exe
        5⤵
        
        PID:5112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16537.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16537.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34225.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42258.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64661.exe
        5⤵
        
        PID:4796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13645.exe
      4⤵
      PID:2332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28324.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28324.exe
      4⤵
      PID:928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63463.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63463.exe
      4⤵
      PID:4088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54512.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54512.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45666.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22376.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22376.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59929.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59929.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7229.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35333.exe
        6⤵
        
        PID:3672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14027.exe
        6⤵
        
        PID:3464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56489.exe
        6⤵
        
        PID:4580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35285.exe
        5⤵
        
        PID:2208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13574.exe
        5⤵
        
        PID:3488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47221.exe
        5⤵
        
        PID:3876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52446.exe
        5⤵
        
        PID:4552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50869.exe
        5⤵
        
        PID:4460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26009.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26009.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34182.exe
        5⤵
        
        PID:664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47376.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51046.exe
        5⤵
        
        PID:3424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19892.exe
        5⤵
        
        PID:3620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61746.exe
        5⤵
        
        PID:2508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58804.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58804.exe
      4⤵
      PID:2524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1439.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1439.exe
      4⤵
      PID:2028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48438.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48438.exe
      4⤵
      PID:3412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60229.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60229.exe
      4⤵
      PID:3568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48354.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48354.exe
      4⤵
      PID:4612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24688.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24688.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62854.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62854.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52446.exe
        5⤵
        
        PID:1788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36888.exe
        5⤵
        
        PID:4696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59582.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59582.exe
      4⤵
      PID:2244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31124.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31124.exe
      4⤵
      PID:3092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38202.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38202.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62507.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62507.exe
      4⤵
      PID:3264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16665.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16665.exe
      4⤵
      PID:4508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43748.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43748.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53982.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53982.exe
    3⤵
    PID:1716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28855.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28855.exe
    3⤵
    PID:2432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58997.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58997.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36171.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36171.exe
    3⤵
    PID:3364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11065.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11065.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4456
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12659.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12659.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16724.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16724.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49062.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49062.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24953.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56202.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23954.exe
        7⤵
        
        PID:2092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47376.exe
        7⤵
        
        PID:2284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34024.exe
        7⤵
        
        PID:3548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19892.exe
        7⤵
        
        PID:3572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47824.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35800.exe
        6⤵
        
        PID:2436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41210.exe
        6⤵
        
        PID:2204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39890.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10227.exe
        6⤵
        
        PID:3832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57280.exe
        6⤵
        
        PID:5092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61298.exe
        5⤵
        
        PID:2776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36003.exe
        6⤵
        
        PID:3224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5606.exe
        6⤵
        
        PID:3556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4526.exe
        6⤵
        
        PID:4172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56362.exe
        5⤵
        
        PID:3048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5662.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17926.exe
        5⤵
        
        PID:3664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29674.exe
        5⤵
        
        PID:4852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14620.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14620.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21748.exe
        5⤵
        
        PID:2748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59261.exe
        6⤵
        
        PID:1208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32703.exe
        6⤵
        
        PID:3496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8107.exe
        6⤵
        
        PID:3756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35896.exe
        6⤵
        
        PID:4488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15380.exe
        6⤵
        
        PID:4156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9954.exe
        5⤵
        
        PID:2372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58100.exe
        5⤵
        
        PID:4020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53919.exe
        5⤵
        
        PID:3764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29380.exe
        5⤵
        
        PID:4972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52322.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52322.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41166.exe
        5⤵
        
        PID:4740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29555.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29555.exe
      4⤵
      PID:2448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27941.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27941.exe
      4⤵
      PID:3976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1391.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1391.exe
      4⤵
      PID:3700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19470.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19470.exe
      4⤵
      PID:5096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21822.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21822.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34486.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34486.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48111.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18476.exe
        6⤵
        
        PID:4052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3566.exe
        6⤵
        
        PID:3528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31412.exe
        6⤵
        
        PID:4744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59582.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31124.exe
        5⤵
        
        PID:3132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38202.exe
        5⤵
        
        PID:3284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62507.exe
        5⤵
        
        PID:3820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36016.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22703.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22703.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42091.exe
        5⤵
        
        PID:4652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7780.exe
      4⤵
      PID:2928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36990.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36990.exe
      4⤵
      PID:1692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14461.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14461.exe
      4⤵
      PID:3256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37446.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37446.exe
      4⤵
      PID:4364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1660.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1660.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62372.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62372.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17842.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17842.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19874.exe
        5⤵
        
        PID:3648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14027.exe
        5⤵
        
        PID:3312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19822.exe
        5⤵
        
        PID:4804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59582.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59582.exe
      4⤵
      PID:2272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31124.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31124.exe
      4⤵
      PID:896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60137.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60137.exe
      4⤵
      PID:4044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29674.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29674.exe
      4⤵
      PID:4872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33612.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33612.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31326.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31326.exe
      4⤵
      PID:1504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48759.exe
      4⤵
      PID:3880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29562.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29562.exe
      4⤵
      PID:2200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57065.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57065.exe
      4⤵
      PID:4688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4980.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4980.exe
    3⤵
    PID:2144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11789.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11789.exe
    3⤵
    PID:3084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14991.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14991.exe
    3⤵
    PID:2252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32981.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32981.exe
    3⤵
    PID:4400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40331.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40331.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5080
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60479.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60479.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28507.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28507.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36956.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36956.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26915.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6627.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47553.exe
        7⤵
        
        PID:2576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18601.exe
        7⤵
        
        PID:3232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65307.exe
        7⤵
        
        PID:3956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41866.exe
        7⤵
        
        PID:4588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27729.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7139.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30776.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27230.exe
        6⤵
        
        PID:4476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64382.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5319.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47882.exe
        6⤵
        
        PID:3792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-292.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51200.exe
        6⤵
        
        PID:4704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49021.exe
        5⤵
        
        PID:2232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52304.exe
        5⤵
        
        PID:3504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5307.exe
        5⤵
        
        PID:3768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10695.exe
        5⤵
        
        PID:4512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15910.exe
        5⤵
        
        PID:4144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14374.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14374.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36990.exe
        5⤵
        
        PID:2148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25575.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49313.exe
        5⤵
        
        PID:3940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35428.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48400.exe
        5⤵
        
        PID:5020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13645.exe
      4⤵
      PID:2020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28324.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28324.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60667.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60667.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8380.exe
      4⤵
      PID:4988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2975.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2975.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53488.exe
      4⤵
      PID:916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37036.exe
        5⤵
        
        PID:2532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6732.exe
        5⤵
        
        PID:2948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59494.exe
        5⤵
        
        PID:3320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19892.exe
        5⤵
        
        PID:3704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48400.exe
        5⤵
        
        PID:5012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22977.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22977.exe
      4⤵
      PID:1088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43566.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43566.exe
      4⤵
      PID:3064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47617.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47617.exe
      4⤵
      PID:3744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11227.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11227.exe
      4⤵
      PID:3444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31864.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31864.exe
      4⤵
      PID:4668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50233.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50233.exe
    3⤵
    PID:1552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39802.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39802.exe
      4⤵
      PID:1632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31583.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31583.exe
      4⤵
      PID:2516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58100.exe
      4⤵
      PID:4012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3418.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3418.exe
      4⤵
      PID:3268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11227.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11227.exe
      4⤵
      PID:3372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31288.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31288.exe
      4⤵
      PID:4596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3522.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3522.exe
    3⤵
    PID:2128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17667.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17667.exe
    3⤵
    PID:584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40158.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40158.exe
    3⤵
    PID:3340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5762.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5762.exe
    3⤵
    PID:3824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22064.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22064.exe
    3⤵
    PID:4676
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61490.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61490.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59161.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59161.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40794.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40794.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34056.exe
        5⤵
        
        PID:2040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58012.exe
        5⤵
        
        PID:3200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17261.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14514.exe
        5⤵
        
        PID:3276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47824.exe
        5⤵
        
        PID:4548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59582.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59582.exe
      4⤵
      PID:2636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31124.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31124.exe
      4⤵
      PID:3124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23127.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23127.exe
      4⤵
      PID:3264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29576.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29576.exe
      4⤵
      PID:3472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26659.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26659.exe
      4⤵
      PID:4960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45267.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45267.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21863.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21863.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27474.exe
      4⤵
      PID:2492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23127.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23127.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53982.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53982.exe
      4⤵
      PID:4348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48246.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48246.exe
      4⤵
      PID:4720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40268.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40268.exe
    3⤵
    PID:2296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49431.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49431.exe
    3⤵
    PID:2852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38952.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38952.exe
    3⤵
    PID:3772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60229.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60229.exe
    3⤵
    PID:3456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48930.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48930.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4832
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16022.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16022.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20338.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20338.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12857.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12857.exe
      4⤵
      PID:2860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65376.exe
      4⤵
      PID:3512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41356.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41356.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61111.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61111.exe
      4⤵
      PID:4564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1867.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1867.exe
      4⤵
      PID:4428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59582.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59582.exe
    3⤵
    PID:784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31124.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31124.exe
    3⤵
    PID:3116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14335.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14335.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29674.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29674.exe
    3⤵
    PID:4840
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60409.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60409.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-87.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-87.exe
    3⤵
    PID:3352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-292.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-292.exe
    3⤵
    PID:4076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50624.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50624.exe
    3⤵
    PID:1928
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5510.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5510.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2500
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7324.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7324.exe
  2⤵
  PID:1992
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3201.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3201.exe
  2⤵
  PID:3172
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40371.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40371.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4104
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48866.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48866.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-22376.exe

Filesize
468KB

MD5
2c9f5b55f8a5d70f3a54f989c8eb429a

SHA1
60b90946ab27d664ab71aed198360cb072a93285

SHA256
cd85f16d1896bd264f81ca7af93e6b44cd7ebf1c51fbf1df4a8a522afadab392

SHA512
44e902623af6ed71d053362697739938e625a85f42f903c45c2416c9e678d9fe5993d7e1040b28ecfb1c6fe59e41b61fe6f39e7ce3f8fe325f4df6fc56455a6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23127.exe

Filesize
468KB

MD5
f6dc67d12c9b48b8bfdbd2324ceac1ab

SHA1
fca91c9fa4df5c3d3bb6fda846d6406f39665e8e

SHA256
99020eefea8492345e17ac041b708a891f4bdea5da8f53397071172f8d603d5c

SHA512
e1a747159eae5bd2773e7001c5bbcd71997d3f11642b65919887d23bccfd7b53f8cebcfb48fc985533012567baa5633db64a2b0cececb1095171d57a839d335b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28507.exe

Filesize
468KB

MD5
6dbe975890e2f88275d8f2852d6688e1

SHA1
575ce9346da01996761554a3422a5842a8caf068

SHA256
d3738daa108d7422f62f3cca1ff4460a579094661408ac03ef7b7aa0652db444

SHA512
d12ed81534dec3bce74bdc4b45ccfd57bfaeb8856e9eb52d5c547b060d81def391e38084846d501a713fcbca71034d73ef2270a2c430b76033fe4ab35b6a7f70

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49062.exe

Filesize
468KB

MD5
680a5c6cd23eeaf8046afcb5ac7fe5fc

SHA1
bb9cddd19360b6181669503f89e5b223f0a5402b

SHA256
fb3c80f5db600e732dfcf1e72b17708f8af9c8405e9e84cd99a72985b262b9b3

SHA512
401cbc74b0f76f2c8bea22a51338a096f29340fa325582e81225e50a744945c103f715f7c8217535c2b1797398d47a5fc4a2738960d3d63af9dd43793b5073de

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52304.exe

Filesize
468KB

MD5
a41cfe9a9b9c5772138702071f61ce8b

SHA1
db2222fa30f1edd4ec6bd3803db5fc8686241851

SHA256
75ec8c7c8b6c0f75a0409c19f275468e30e241094bb7b762401cf33ee7a76487

SHA512
2d2ba7c503e7f24f669b2b90249ba5a37b4492bbacedd5585d0571e12e6677def046c1ded28c905b0e8f7da84b92b436a77f749e6c91dd0b20f4707b9aa19332

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60479.exe

Filesize
468KB

MD5
850f5ea6185510011d2dbfd857ef41ee

SHA1
d8fccd0e3c9c2cd348a29df8c32afa85068ad3ad

SHA256
3dcfbdded8aaf7099d1303b2946ef55154d0dbd03dfbc5f4d23ba0a27d2aeaba

SHA512
098e8b8fcde2a6214b0c484f80f636bcc93a056306535cb8b09fab95bea7b272b2907881fe131d048c6d799dd8218f6e4ed54ef3ed722f2ce093f064c1acff23

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-11407.exe

Filesize
468KB

MD5
c8d0d27738ddd662c955f68eb68df15d

SHA1
bef210b179eef3fc9b624e1fa14c211bb207e2e6

SHA256
171f18a4a9e0970dcb011868dbc38958a5c039fd440c990e0a3119e0501f8ad4

SHA512
325d20c763486f73cb028d1d17fa1cad1d06877cfa7c5229a1382790213b18c20e236b17c846b1780e7c8584f34825a9728fa069750c45c29fd4c18e80c4f9ba

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-11663.exe

Filesize
468KB

MD5
53ec7e5a26f673ad6e70ae4266a7e46a

SHA1
5bd1c03bb2258f1f900d6104a512533b8c5373d0

SHA256
cc62f1cd2e70309e1c6c319e374471634ba5674fc95a008491d597b4ad479e0e

SHA512
b7de498be6324e8ea7439b566006023dcf05f06a9d045d830effd871f41fe6ffb60e0673afd8a8275cbbd4ee5cce169a6fc00c4009c3bec13aa66e18e56220f1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-12659.exe

Filesize
468KB

MD5
8b4c2574b54f5e00730c8284afb9e9f8

SHA1
dd6e2ff739c00681c5bce4701739f2eb6449ac63

SHA256
0bee6f202a826a932b301a9aa74bf940d8064bc62fd8a6d67a5ccd1fbd0bb5f9

SHA512
279ad97243db71dd243ce8ca7d237e0a7fed2ce7891a7d0920ea37c6c13d210cec8b3dbd0dfb681cb7bbc0aa3357c1ee86e97242ab3ba7cb320624f851ca9846

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-1548.exe

Filesize
468KB

MD5
367bf7b50ce273b6096cd6ab4fd048c3

SHA1
6d9000cb18305fea7b671deb010c7254e0354f1a

SHA256
ff3b8bc634b02fe4eb115a1e02e7fd1d0576933f9d23c57ab3a99671952edc5f

SHA512
7129aa33ef6613265f6f45fe303b70b1b2b28eaa16181c15ccb55db3c55eb4756adbfe70b6133779db99394fdee4a96d52a02d57d4636582a56e8bb40845a57e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-16724.exe

Filesize
468KB

MD5
a3f242b6a1aeb55e4478a52c90abcbd6

SHA1
d1df4e358456c6e6e4308e976184bfe35ba1d9d5

SHA256
3dd225b3b8d23195576511dc847abd3abbf435d766e90a75734db758899882ef

SHA512
cfb168aa74f314eacdb69383d781e9fff0f9cf357aa85004fe2fe817a767d2a7c207ddef9b361af263e66e3d24e54490e89c82db336f09949d0b1a6006a9db32

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-21822.exe

Filesize
468KB

MD5
985c67664a54b39d786454cb8d82cdaa

SHA1
ee9070c5aa8e5b35f998e2d8e436fe26ec6033e8

SHA256
9da2e9497dd6376cb12aac36ef821a041689797622c09debf50747d93dc28e69

SHA512
18265df23481cf8fc1b8e31c192fc702d9ab297ec1537e214c0740d71771d5e6236b079ffa4f9fbd676d20175e884068ac1c39b6b3f6fbf0ff6b7fc6dccd426b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-24166.exe

Filesize
468KB

MD5
d4121f4ccfa9d48e7ed52a7a2f8c790d

SHA1
c578d2477f6ef23269b5cf241aedc7fcb7705032

SHA256
b21b38c2a43da6b743d64579ea2acd150af52ce2146ed2a0286f6cd2e3265b62

SHA512
343d181e151efd96553e8e502057a0a84d0851f245532c992fa4c53733237208138ff51dc41a4e1afa00a01dbb4779f45f3a1079f537a25a48dcd78cb2b9353e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-2975.exe

Filesize
468KB

MD5
666f549a941129b35bec9397758f1a6a

SHA1
2e941c44b189ab755f1195085ac0ae6d39d4427f

SHA256
9b207a0bc355d4509c17812a6e3f71259b1e21dcc7ad1cea354f908bd7387ee0

SHA512
d87d2585e2fb16cddfd079010123b5a71ef67696da64510ee23eca88b11bc50eb78bb7a7c526f47e13221302d82766ff94df1a6706a44ee32eec4111afde6f10

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-33143.exe

Filesize
468KB

MD5
c38f85eb0d5fbf668e6cd3c6d046c594

SHA1
070505abf52304e734b7ad59dd010a68da5df24b

SHA256
c1c08dddb55cf04aac98e9f8bfe7762c23b98286fc5304140bc7e70adfafd31e

SHA512
12de3a5ca7b6cb2211b0e6e37a1f6cc35328a33be99d0f3e9a1fc93e64458ca1cf8f9ae0fa1f2916703f19fe5bdedb1d51414decc89b594624ff2378d95d2305

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-36956.exe

Filesize
468KB

MD5
0d1aa6daa6bf8a35d5c34ffbb33af890

SHA1
bd74bd9b227b4ef07fe576f95463a37fc5e2fdd6

SHA256
a75ccde35dc771d680ca221887d1f821f4b706b4ecee1af28fbb94c8060c9d16

SHA512
65b0113fa9f8f615ccee4f0a8bb3c988a4e9e2465c05b1ef5fc47f56cd5408992080163ca026505688c0a7631039fa41c1fea08c25012734802bedde3ba5ae7e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-44454.exe

Filesize
468KB

MD5
f94dee5cbeac20171ee0103c80c8980d

SHA1
8f76e338a14d26c0cb0fdce3770fad4154c1e74b

SHA256
30e7d30940549c001fbf780bdbac25803056e3fb162a254e44fb2f212d37058e

SHA512
cae45cff9753168a3a16a055d9cb52d0ba08adbcbbf0c80c129afeca954c6e0518194e4bc132ef1ea31770545a7402c37f78843ceba9cde03e3d8aeebcb384eb

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-45950.exe

Filesize
468KB

MD5
f94b8bfc2c93d623b61be60fd9ae8bf0

SHA1
c58f3ec95d62956dea0448c3df80a35abc5e378f

SHA256
28d9306922d3ced406d9ccae246617011a55320c567c5e8f5f54a5882dcba698

SHA512
194620c2e72e1a234a36149992459d11afa36de3cc70967b63fd53f475b741cd84011504e83b75715338c4e3152a78e36b92e33ab05dd08b20480a0d7f6966f3

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-60617.exe

Filesize
468KB

MD5
7cf856180bd6f66b6bcf685e5bff6b32

SHA1
365f352d94a47bfd2e0d2269ff4bc13872c5cac0

SHA256
015ab23e154e3ce57f2ce749090204f7f393063adb7cfe6c67040d121f063ed6

SHA512
b0cb4439058456fd77891ac02c206e0c69701246e083bde8160da3e0d620dc2f6449c7b17cd347ef47d38a518379fc2469f6a6139adc5bc975580084c3c98074

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-61490.exe

Filesize
468KB

MD5
eb474a5f5c052385d8c9da0d91c738e5

SHA1
6336482b0331edc80b288ba1f845bf911f865b2d

SHA256
f455aef81e7a4d581a1f8f7e930fc3979893e17485e4d9f878a0ff433bc4206f

SHA512
9eb446ee91a5d81b5bfec412a4ceac552c349656ae667e69c17cb30d46bf39c9aa8351ff75a91be1c8a2646909b65329f6438bf103b500ee7faba40df1e4b0c3

Download Submit