8ffddbb5cfeb8134edb700db07cedb5fe4eebf1e90978ac4527b9fe64b179154

Analysis

max time kernel
120s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10/10/2024, 14:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8ffddbb5cfeb8134edb700db07cedb5fe4eebf1e90978ac4527b9fe64b179154N.exe
Size

468KB
MD5

7abc7208764326352f95109408f321b0
SHA1

584d74f5644204dcfb7d4c82d0189af9dbfc2246
SHA256

8ffddbb5cfeb8134edb700db07cedb5fe4eebf1e90978ac4527b9fe64b179154
SHA512

4816a5690e599e11126cd7b88146f5e3438eea7b938c4a6464e5b769b1c7f1cb04f004bbe8a733d608f76d6f8b1f04836057970679ee1ae2e596b172d1e1fee1
SSDEEP

3072:ibzoogIdId5UtbYHPztjcfq/sCtvP3prhmHegVhtRct8gT2uGJl2:ibcowbUtoPJjcf4ZfsRcCW2uG

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2468	Unicorn-27229.exe
2164	Unicorn-3445.exe
2804	Unicorn-23311.exe
2824	Unicorn-23537.exe
1616	Unicorn-61947.exe
2648	Unicorn-18877.exe
2712	Unicorn-64548.exe
1944	Unicorn-9997.exe
320	Unicorn-18720.exe
2952	Unicorn-42670.exe
2912	Unicorn-34429.exe
700	Unicorn-56266.exe
1996	Unicorn-52182.exe
2236	Unicorn-48845.exe
1712	Unicorn-62580.exe
920	Unicorn-54559.exe
1340	Unicorn-49306.exe
1056	Unicorn-55436.exe
3028	Unicorn-39737.exe
1776	Unicorn-23916.exe
2976	Unicorn-39490.exe
3036	Unicorn-48420.exe
560	Unicorn-7558.exe
2052	Unicorn-27424.exe
888	Unicorn-36146.exe
108	Unicorn-2727.exe
2680	Unicorn-11279.exe
2492	Unicorn-20002.exe
2740	Unicorn-33737.exe
2796	Unicorn-39868.exe
2800	Unicorn-39603.exe
2612	Unicorn-62893.exe
2284	Unicorn-1995.exe
2892	Unicorn-55685.exe
1120	Unicorn-43360.exe
2940	Unicorn-6676.exe
2928	Unicorn-6676.exe
2088	Unicorn-45087.exe
2016	Unicorn-2571.exe
1052	Unicorn-10376.exe
848	Unicorn-9290.exe
1448	Unicorn-48477.exe
1156	Unicorn-61284.exe
2148	Unicorn-64813.exe
1516	Unicorn-15612.exe
1108	Unicorn-52540.exe
2516	Unicorn-28227.exe
836	Unicorn-54215.exe
1580	Unicorn-60345.exe
1936	Unicorn-49160.exe
1652	Unicorn-13728.exe
880	Unicorn-33594.exe
2368	Unicorn-24663.exe
1608	Unicorn-50314.exe
2900	Unicorn-5197.exe
2792	Unicorn-54133.exe
1716	Unicorn-18004.exe
1152	Unicorn-45654.exe
2672	Unicorn-62545.exe
2212	Unicorn-10743.exe
2012	Unicorn-59058.exe
2968	Unicorn-22664.exe
2032	Unicorn-38446.exe
2168	Unicorn-22302.exe

Loads dropped DLL 64 IoCs

pid	Process
2524	8ffddbb5cfeb8134edb700db07cedb5fe4eebf1e90978ac4527b9fe64b179154N.exe
2524	8ffddbb5cfeb8134edb700db07cedb5fe4eebf1e90978ac4527b9fe64b179154N.exe
2524	8ffddbb5cfeb8134edb700db07cedb5fe4eebf1e90978ac4527b9fe64b179154N.exe
2524	8ffddbb5cfeb8134edb700db07cedb5fe4eebf1e90978ac4527b9fe64b179154N.exe
2468	Unicorn-27229.exe
2468	Unicorn-27229.exe
2164	Unicorn-3445.exe
2164	Unicorn-3445.exe
2524	8ffddbb5cfeb8134edb700db07cedb5fe4eebf1e90978ac4527b9fe64b179154N.exe
2524	8ffddbb5cfeb8134edb700db07cedb5fe4eebf1e90978ac4527b9fe64b179154N.exe
2804	Unicorn-23311.exe
2804	Unicorn-23311.exe
2468	Unicorn-27229.exe
2468	Unicorn-27229.exe
2824	Unicorn-23537.exe
2824	Unicorn-23537.exe
2164	Unicorn-3445.exe
2164	Unicorn-3445.exe
1616	Unicorn-61947.exe
1616	Unicorn-61947.exe
2524	8ffddbb5cfeb8134edb700db07cedb5fe4eebf1e90978ac4527b9fe64b179154N.exe
2524	8ffddbb5cfeb8134edb700db07cedb5fe4eebf1e90978ac4527b9fe64b179154N.exe
2648	Unicorn-18877.exe
2648	Unicorn-18877.exe
2712	Unicorn-64548.exe
2712	Unicorn-64548.exe
2804	Unicorn-23311.exe
2468	Unicorn-27229.exe
2804	Unicorn-23311.exe
2468	Unicorn-27229.exe
320	Unicorn-18720.exe
320	Unicorn-18720.exe
2164	Unicorn-3445.exe
2164	Unicorn-3445.exe
2952	Unicorn-42670.exe
2952	Unicorn-42670.exe
1616	Unicorn-61947.exe
1616	Unicorn-61947.exe
2912	Unicorn-34429.exe
2912	Unicorn-34429.exe
2524	8ffddbb5cfeb8134edb700db07cedb5fe4eebf1e90978ac4527b9fe64b179154N.exe
2524	8ffddbb5cfeb8134edb700db07cedb5fe4eebf1e90978ac4527b9fe64b179154N.exe
1944	Unicorn-9997.exe
1944	Unicorn-9997.exe
2824	Unicorn-23537.exe
2824	Unicorn-23537.exe
700	Unicorn-56266.exe
700	Unicorn-56266.exe
2648	Unicorn-18877.exe
2648	Unicorn-18877.exe
1996	Unicorn-52182.exe
1996	Unicorn-52182.exe
1712	Unicorn-62580.exe
1712	Unicorn-62580.exe
2712	Unicorn-64548.exe
2804	Unicorn-23311.exe
2468	Unicorn-27229.exe
2712	Unicorn-64548.exe
2236	Unicorn-48845.exe
2804	Unicorn-23311.exe
2236	Unicorn-48845.exe
2468	Unicorn-27229.exe
920	Unicorn-54559.exe
920	Unicorn-54559.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39945.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16909.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53353.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51963.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38180.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29514.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12421.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18877.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53459.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29514.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63348.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35456.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37217.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54559.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6676.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40526.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36371.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39945.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38180.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9100.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6299.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41772.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8005.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25575.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48887.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65411.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61469.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55706.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2478.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27705.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8795.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57636.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61080.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6676.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4258.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28950.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8569.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38180.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30045.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25077.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47900.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15686.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27705.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35751.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29514.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16909.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13355.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63348.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42861.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14434.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27085.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42943.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4339.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59648.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10074.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35213.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26380.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29514.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35299.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45945.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14876.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13728.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8569.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35098.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2524	8ffddbb5cfeb8134edb700db07cedb5fe4eebf1e90978ac4527b9fe64b179154N.exe
2468	Unicorn-27229.exe
2164	Unicorn-3445.exe
2804	Unicorn-23311.exe
2824	Unicorn-23537.exe
1616	Unicorn-61947.exe
2648	Unicorn-18877.exe
2712	Unicorn-64548.exe
320	Unicorn-18720.exe
1944	Unicorn-9997.exe
2952	Unicorn-42670.exe
2912	Unicorn-34429.exe
700	Unicorn-56266.exe
1996	Unicorn-52182.exe
1712	Unicorn-62580.exe
2236	Unicorn-48845.exe
920	Unicorn-54559.exe
1340	Unicorn-49306.exe
1056	Unicorn-55436.exe
3028	Unicorn-39737.exe
1776	Unicorn-23916.exe
2052	Unicorn-27424.exe
560	Unicorn-7558.exe
888	Unicorn-36146.exe
2976	Unicorn-39490.exe
3036	Unicorn-48420.exe
108	Unicorn-2727.exe
2680	Unicorn-11279.exe
2800	Unicorn-39603.exe
2796	Unicorn-39868.exe
2740	Unicorn-33737.exe
2492	Unicorn-20002.exe
2612	Unicorn-62893.exe
2284	Unicorn-1995.exe
2892	Unicorn-55685.exe
1120	Unicorn-43360.exe
2940	Unicorn-6676.exe
2928	Unicorn-6676.exe
2088	Unicorn-45087.exe
2016	Unicorn-2571.exe
1052	Unicorn-10376.exe
848	Unicorn-9290.exe
1448	Unicorn-48477.exe
2148	Unicorn-64813.exe
1156	Unicorn-61284.exe
1516	Unicorn-15612.exe
1108	Unicorn-52540.exe
2516	Unicorn-28227.exe
1580	Unicorn-60345.exe
836	Unicorn-54215.exe
2900	Unicorn-5197.exe
1608	Unicorn-50314.exe
1936	Unicorn-49160.exe
2792	Unicorn-54133.exe
880	Unicorn-33594.exe
2672	Unicorn-62545.exe
1152	Unicorn-45654.exe
2212	Unicorn-10743.exe
1652	Unicorn-13728.exe
1716	Unicorn-18004.exe
2368	Unicorn-24663.exe
2012	Unicorn-59058.exe
2968	Unicorn-22664.exe
2168	Unicorn-22302.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 2468	2524	8ffddbb5cfeb8134edb700db07cedb5fe4eebf1e90978ac4527b9fe64b179154N.exe	30
PID 2524 wrote to memory of 2468	2524	8ffddbb5cfeb8134edb700db07cedb5fe4eebf1e90978ac4527b9fe64b179154N.exe	30
PID 2524 wrote to memory of 2468	2524	8ffddbb5cfeb8134edb700db07cedb5fe4eebf1e90978ac4527b9fe64b179154N.exe	30
PID 2524 wrote to memory of 2468	2524	8ffddbb5cfeb8134edb700db07cedb5fe4eebf1e90978ac4527b9fe64b179154N.exe	30
PID 2524 wrote to memory of 2164	2524	8ffddbb5cfeb8134edb700db07cedb5fe4eebf1e90978ac4527b9fe64b179154N.exe	31
PID 2524 wrote to memory of 2164	2524	8ffddbb5cfeb8134edb700db07cedb5fe4eebf1e90978ac4527b9fe64b179154N.exe	31
PID 2524 wrote to memory of 2164	2524	8ffddbb5cfeb8134edb700db07cedb5fe4eebf1e90978ac4527b9fe64b179154N.exe	31
PID 2524 wrote to memory of 2164	2524	8ffddbb5cfeb8134edb700db07cedb5fe4eebf1e90978ac4527b9fe64b179154N.exe	31
PID 2468 wrote to memory of 2804	2468	Unicorn-27229.exe	32
PID 2468 wrote to memory of 2804	2468	Unicorn-27229.exe	32
PID 2468 wrote to memory of 2804	2468	Unicorn-27229.exe	32
PID 2468 wrote to memory of 2804	2468	Unicorn-27229.exe	32
PID 2164 wrote to memory of 2824	2164	Unicorn-3445.exe	33
PID 2164 wrote to memory of 2824	2164	Unicorn-3445.exe	33
PID 2164 wrote to memory of 2824	2164	Unicorn-3445.exe	33
PID 2164 wrote to memory of 2824	2164	Unicorn-3445.exe	33
PID 2524 wrote to memory of 1616	2524	8ffddbb5cfeb8134edb700db07cedb5fe4eebf1e90978ac4527b9fe64b179154N.exe	34
PID 2524 wrote to memory of 1616	2524	8ffddbb5cfeb8134edb700db07cedb5fe4eebf1e90978ac4527b9fe64b179154N.exe	34
PID 2524 wrote to memory of 1616	2524	8ffddbb5cfeb8134edb700db07cedb5fe4eebf1e90978ac4527b9fe64b179154N.exe	34
PID 2524 wrote to memory of 1616	2524	8ffddbb5cfeb8134edb700db07cedb5fe4eebf1e90978ac4527b9fe64b179154N.exe	34
PID 2804 wrote to memory of 2648	2804	Unicorn-23311.exe	35
PID 2804 wrote to memory of 2648	2804	Unicorn-23311.exe	35
PID 2804 wrote to memory of 2648	2804	Unicorn-23311.exe	35
PID 2804 wrote to memory of 2648	2804	Unicorn-23311.exe	35
PID 2468 wrote to memory of 2712	2468	Unicorn-27229.exe	36
PID 2468 wrote to memory of 2712	2468	Unicorn-27229.exe	36
PID 2468 wrote to memory of 2712	2468	Unicorn-27229.exe	36
PID 2468 wrote to memory of 2712	2468	Unicorn-27229.exe	36
PID 2824 wrote to memory of 1944	2824	Unicorn-23537.exe	38
PID 2824 wrote to memory of 1944	2824	Unicorn-23537.exe	38
PID 2824 wrote to memory of 1944	2824	Unicorn-23537.exe	38
PID 2824 wrote to memory of 1944	2824	Unicorn-23537.exe	38
PID 2164 wrote to memory of 320	2164	Unicorn-3445.exe	39
PID 2164 wrote to memory of 320	2164	Unicorn-3445.exe	39
PID 2164 wrote to memory of 320	2164	Unicorn-3445.exe	39
PID 2164 wrote to memory of 320	2164	Unicorn-3445.exe	39
PID 1616 wrote to memory of 2952	1616	Unicorn-61947.exe	40
PID 1616 wrote to memory of 2952	1616	Unicorn-61947.exe	40
PID 1616 wrote to memory of 2952	1616	Unicorn-61947.exe	40
PID 1616 wrote to memory of 2952	1616	Unicorn-61947.exe	40
PID 2524 wrote to memory of 2912	2524	8ffddbb5cfeb8134edb700db07cedb5fe4eebf1e90978ac4527b9fe64b179154N.exe	41
PID 2524 wrote to memory of 2912	2524	8ffddbb5cfeb8134edb700db07cedb5fe4eebf1e90978ac4527b9fe64b179154N.exe	41
PID 2524 wrote to memory of 2912	2524	8ffddbb5cfeb8134edb700db07cedb5fe4eebf1e90978ac4527b9fe64b179154N.exe	41
PID 2524 wrote to memory of 2912	2524	8ffddbb5cfeb8134edb700db07cedb5fe4eebf1e90978ac4527b9fe64b179154N.exe	41
PID 2648 wrote to memory of 700	2648	Unicorn-18877.exe	42
PID 2648 wrote to memory of 700	2648	Unicorn-18877.exe	42
PID 2648 wrote to memory of 700	2648	Unicorn-18877.exe	42
PID 2648 wrote to memory of 700	2648	Unicorn-18877.exe	42
PID 2712 wrote to memory of 1996	2712	Unicorn-64548.exe	43
PID 2712 wrote to memory of 1996	2712	Unicorn-64548.exe	43
PID 2712 wrote to memory of 1996	2712	Unicorn-64548.exe	43
PID 2712 wrote to memory of 1996	2712	Unicorn-64548.exe	43
PID 2804 wrote to memory of 2236	2804	Unicorn-23311.exe	44
PID 2804 wrote to memory of 2236	2804	Unicorn-23311.exe	44
PID 2804 wrote to memory of 2236	2804	Unicorn-23311.exe	44
PID 2804 wrote to memory of 2236	2804	Unicorn-23311.exe	44
PID 2468 wrote to memory of 1712	2468	Unicorn-27229.exe	45
PID 2468 wrote to memory of 1712	2468	Unicorn-27229.exe	45
PID 2468 wrote to memory of 1712	2468	Unicorn-27229.exe	45
PID 2468 wrote to memory of 1712	2468	Unicorn-27229.exe	45
PID 320 wrote to memory of 920	320	Unicorn-18720.exe	46
PID 320 wrote to memory of 920	320	Unicorn-18720.exe	46
PID 320 wrote to memory of 920	320	Unicorn-18720.exe	46
PID 320 wrote to memory of 920	320	Unicorn-18720.exe	46

C:\Users\Admin\AppData\Local\Temp\8ffddbb5cfeb8134edb700db07cedb5fe4eebf1e90978ac4527b9fe64b179154N.exe
"C:\Users\Admin\AppData\Local\Temp\8ffddbb5cfeb8134edb700db07cedb5fe4eebf1e90978ac4527b9fe64b179154N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27229.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27229.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23311.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23311.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18877.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18877.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56266.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27424.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15612.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44907.exe
        8⤵
        
        PID:2448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18255.exe
        9⤵
        
        PID:4092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3898.exe
        9⤵
        
        PID:4668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15625.exe
        9⤵
        
        PID:5456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10074.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20044.exe
        8⤵
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10858.exe
        8⤵
        
        PID:3188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41772.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41427.exe
        8⤵
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18597.exe
        8⤵
        
        PID:7076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62950.exe
        7⤵
        
        PID:2964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56163.exe
        8⤵
        
        PID:3276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45507.exe
        8⤵
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7457.exe
        8⤵
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44584.exe
        8⤵
        
        PID:6376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10043.exe
        7⤵
        
        PID:1948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16723.exe
        7⤵
        
        PID:4024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5186.exe
        7⤵
        
        PID:4664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15963.exe
        7⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37217.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28227.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9468.exe
        7⤵
        
        PID:496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40526.exe
        7⤵
        
        PID:3480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21928.exe
        7⤵
        
        PID:4196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29514.exe
        7⤵
        
        PID:4832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41100.exe
        7⤵
        
        PID:5332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18597.exe
        7⤵
        
        PID:6956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59638.exe
        6⤵
        
        PID:2000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46391.exe
        6⤵
        
        PID:3644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27705.exe
        6⤵
        
        PID:3268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12979.exe
        6⤵
        
        PID:4368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51643.exe
        6⤵
        
        PID:5988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36146.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64621.exe
        6⤵
        
        PID:2828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63376.exe
        7⤵
        
        PID:3820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16770.exe
        7⤵
        
        PID:3248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32314.exe
        7⤵
        
        PID:5092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59778.exe
        7⤵
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18067.exe
        7⤵
        
        PID:7084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36987.exe
        6⤵
        
        PID:1332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16723.exe
        6⤵
        
        PID:3396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50303.exe
        6⤵
        
        PID:4500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61080.exe
        6⤵
        
        PID:5772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28281.exe
        6⤵
        
        PID:6328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54215.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49370.exe
        6⤵
        
        PID:1344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26790.exe
        6⤵
        
        PID:3488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63178.exe
        6⤵
        
        PID:4144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38180.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4351.exe
        6⤵
        
        PID:5532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45981.exe
        5⤵
        
        PID:2544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19739.exe
        5⤵
        
        PID:3988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10550.exe
        5⤵
        
        PID:4996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13355.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45945.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48845.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48845.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39868.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64813.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-558.exe
        7⤵
        
        PID:908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40526.exe
        7⤵
        
        PID:3448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36371.exe
        7⤵
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29514.exe
        7⤵
        
        PID:5084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37509.exe
        7⤵
        
        PID:5852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18597.exe
        7⤵
        
        PID:7000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60703.exe
        6⤵
        
        PID:2932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10043.exe
        6⤵
        
        PID:1556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16723.exe
        6⤵
        
        PID:3428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50303.exe
        6⤵
        
        PID:4524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3711.exe
        6⤵
        
        PID:5812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-460.exe
        6⤵
        
        PID:6480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52540.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63656.exe
        6⤵
        
        PID:1888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26790.exe
        6⤵
        
        PID:3780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35751.exe
        6⤵
        
        PID:4804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16909.exe
        6⤵
        
        PID:5284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10255.exe
        6⤵
        
        PID:6224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51278.exe
        5⤵
        
        PID:2668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30507.exe
        6⤵
        
        PID:3136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16150.exe
        6⤵
        
        PID:4936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19709.exe
        6⤵
        
        PID:5292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47900.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46391.exe
        5⤵
        
        PID:3560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27705.exe
        5⤵
        
        PID:3256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12421.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8042.exe
        5⤵
        
        PID:6080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33737.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33737.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33594.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28950.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2478.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16063.exe
        6⤵
        
        PID:4224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38180.exe
        6⤵
        
        PID:4552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37203.exe
        6⤵
        
        PID:5628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26380.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22539.exe
        5⤵
        
        PID:3928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35751.exe
        5⤵
        
        PID:4916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16909.exe
        5⤵
        
        PID:5140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63348.exe
        5⤵
        
        PID:5752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54133.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54133.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33807.exe
        5⤵
        
        PID:2152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23251.exe
        6⤵
        
        PID:536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10858.exe
        6⤵
        
        PID:4088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54024.exe
        6⤵
        
        PID:4172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37343.exe
        6⤵
        
        PID:5148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18597.exe
        6⤵
        
        PID:7016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35098.exe
        5⤵
        
        PID:2192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39945.exe
        5⤵
        
        PID:3724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35751.exe
        5⤵
        
        PID:4908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16909.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63348.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6101.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6101.exe
      4⤵
      PID:2456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14444.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14444.exe
      4⤵
      PID:2748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8588.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8588.exe
      4⤵
      PID:3996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45638.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45638.exe
      4⤵
      PID:4740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6163.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6163.exe
      4⤵
      PID:5916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14551.exe
      4⤵
      PID:6700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64548.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64548.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52182.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52182.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2727.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50314.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5218.exe
        7⤵
        
        PID:1256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43117.exe
        8⤵
        
        PID:876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62660.exe
        8⤵
        
        PID:3284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27529.exe
        8⤵
        
        PID:4372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17235.exe
        8⤵
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1409.exe
        8⤵
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40526.exe
        7⤵
        
        PID:3700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36371.exe
        7⤵
        
        PID:1704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29514.exe
        7⤵
        
        PID:4848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34577.exe
        7⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18597.exe
        7⤵
        
        PID:7036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38061.exe
        6⤵
        
        PID:1692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25809.exe
        7⤵
        
        PID:5116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29399.exe
        7⤵
        
        PID:5492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10043.exe
        6⤵
        
        PID:816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30507.exe
        7⤵
        
        PID:3144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16150.exe
        7⤵
        
        PID:4972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19709.exe
        7⤵
        
        PID:5272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15803.exe
        7⤵
        
        PID:6432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16723.exe
        6⤵
        
        PID:4016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5186.exe
        6⤵
        
        PID:4732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15963.exe
        6⤵
        
        PID:5904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18004.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49178.exe
        6⤵
        
        PID:2116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26790.exe
        6⤵
        
        PID:3604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1725.exe
        6⤵
        
        PID:3224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38180.exe
        6⤵
        
        PID:4516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54045.exe
        6⤵
        
        PID:5764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43240.exe
        5⤵
        
        PID:1132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46391.exe
        5⤵
        
        PID:3496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27705.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12979.exe
        5⤵
        
        PID:4284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32738.exe
        5⤵
        
        PID:5696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20002.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20002.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5197.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3874.exe
        6⤵
        
        PID:2500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26039.exe
        7⤵
        
        PID:3172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16150.exe
        7⤵
        
        PID:4944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7841.exe
        7⤵
        
        PID:4164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23012.exe
        7⤵
        
        PID:5244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57953.exe
        6⤵
        
        PID:3180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10858.exe
        6⤵
        
        PID:4072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63820.exe
        6⤵
        
        PID:4868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32498.exe
        6⤵
        
        PID:5940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45654.exe
        5⤵
        
        PID:1512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49265.exe
        6⤵
        
        PID:5652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33779.exe
        5⤵
        
        PID:2664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16723.exe
        5⤵
        
        PID:4012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24729.exe
        5⤵
        
        PID:4404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57572.exe
        5⤵
        
        PID:5712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11176.exe
        5⤵
        
        PID:6088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10743.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10743.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61492.exe
        5⤵
        
        PID:264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26790.exe
        5⤵
        
        PID:3788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11979.exe
        5⤵
        
        PID:4312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38180.exe
        5⤵
        
        PID:4728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4351.exe
        5⤵
        
        PID:5544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65503.exe
      4⤵
      PID:2316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37725.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37725.exe
      4⤵
      PID:3672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11170.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11170.exe
      4⤵
      PID:3916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30045.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30045.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48887.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57268.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57268.exe
      4⤵
      PID:7100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62580.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62580.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11279.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11279.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30089.exe
        5⤵
        
        PID:1880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46391.exe
        5⤵
        
        PID:3504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60378.exe
        5⤵
        
        PID:4216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12979.exe
        5⤵
        
        PID:4104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58166.exe
        5⤵
        
        PID:5336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62604.exe
        5⤵
        
        PID:6184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13728.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13728.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14149.exe
        5⤵
        
        PID:2608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26209.exe
        5⤵
        
        PID:3968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17633.exe
        5⤵
        
        PID:4708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21490.exe
        5⤵
        
        PID:5440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8569.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8569.exe
      4⤵
      PID:2632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45810.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45810.exe
      4⤵
      PID:3652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53459.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53459.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45514.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45514.exe
      4⤵
      PID:6044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10351.exe
      4⤵
      PID:6656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39603.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39603.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49930.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49930.exe
      4⤵
      PID:2960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30465.exe
        5⤵
        
        PID:2876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26790.exe
        5⤵
        
        PID:3664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35751.exe
        5⤵
        
        PID:4952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12825.exe
        5⤵
        
        PID:5372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2015.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2015.exe
      4⤵
      PID:3032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46391.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46391.exe
      4⤵
      PID:3612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9179.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9179.exe
      4⤵
      PID:4392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12979.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12979.exe
      4⤵
      PID:4352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65411.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65411.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24663.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24663.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14699.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14699.exe
      4⤵
      PID:3016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26209.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26209.exe
      4⤵
      PID:3892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10858.exe
      4⤵
      PID:3152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63820.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63820.exe
      4⤵
      PID:4880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24522.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24522.exe
      4⤵
      PID:5960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20151.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20151.exe
      4⤵
      PID:6744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54771.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54771.exe
    3⤵
    PID:1876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37675.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37675.exe
    3⤵
    PID:3708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59369.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59369.exe
    3⤵
    PID:4764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56110.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56110.exe
    3⤵
    PID:5156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44810.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44810.exe
    3⤵
    PID:5592
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3445.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3445.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23537.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23537.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9997.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9997.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48420.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48477.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40439.exe
        7⤵
        
        PID:2628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18400.exe
        8⤵
        
        PID:2292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10091.exe
        9⤵
        
        PID:3808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60748.exe
        9⤵
        
        PID:5060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35299.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45352.exe
        9⤵
        
        PID:6644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8804.exe
        8⤵
        
        PID:3884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29885.exe
        8⤵
        
        PID:4900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25575.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31066.exe
        8⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49017.exe
        7⤵
        
        PID:1328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10858.exe
        7⤵
        
        PID:4084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13851.exe
        7⤵
        
        PID:4744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40865.exe
        7⤵
        
        PID:5564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19997.exe
        6⤵
        
        PID:2640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55779.exe
        7⤵
        
        PID:4076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62549.exe
        7⤵
        
        PID:4348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47743.exe
        7⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45352.exe
        7⤵
        
        PID:6672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36987.exe
        6⤵
        
        PID:2428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16723.exe
        6⤵
        
        PID:3408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37488.exe
        6⤵
        
        PID:3164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43802.exe
        6⤵
        
        PID:5320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62604.exe
        6⤵
        
        PID:6176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61284.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16354.exe
        6⤵
        
        PID:2676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40526.exe
        6⤵
        
        PID:3472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21928.exe
        6⤵
        
        PID:4268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29514.exe
        6⤵
        
        PID:4464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54269.exe
        6⤵
        
        PID:5640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42861.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63516.exe
        6⤵
        
        PID:2020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44466.exe
        6⤵
        
        PID:3852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25801.exe
        6⤵
        
        PID:5028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13322.exe
        6⤵
        
        PID:5216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26790.exe
        6⤵
        
        PID:6192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42852.exe
        5⤵
        
        PID:1824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8058.exe
        5⤵
        
        PID:3420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8194.exe
        5⤵
        
        PID:4376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9100.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45945.exe
        5⤵
        
        PID:5548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7558.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7558.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10376.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4258.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61492.exe
        7⤵
        
        PID:1964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26790.exe
        7⤵
        
        PID:3772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16063.exe
        7⤵
        
        PID:4236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38180.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57636.exe
        7⤵
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1532.exe
        7⤵
        
        PID:6156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41626.exe
        6⤵
        
        PID:1640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40526.exe
        6⤵
        
        PID:3680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17844.exe
        6⤵
        
        PID:4380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29514.exe
        6⤵
        
        PID:4472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41100.exe
        6⤵
        
        PID:5464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18597.exe
        6⤵
        
        PID:6992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50122.exe
        5⤵
        
        PID:2788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23251.exe
        6⤵
        
        PID:2860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64767.exe
        6⤵
        
        PID:3216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3287.exe
        6⤵
        
        PID:4540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61080.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28281.exe
        6⤵
        
        PID:6340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8569.exe
        5⤵
        
        PID:796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45810.exe
        5⤵
        
        PID:3828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14833.exe
        5⤵
        
        PID:4776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61827.exe
        5⤵
        
        PID:5356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1939.exe
        5⤵
        
        PID:6056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9290.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9290.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52499.exe
        5⤵
        
        PID:2656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14699.exe
        6⤵
        
        PID:2988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26209.exe
        6⤵
        
        PID:3960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29885.exe
        6⤵
        
        PID:4892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7475.exe
        6⤵
        
        PID:5740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60371.exe
        5⤵
        
        PID:2416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39945.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23499.exe
        5⤵
        
        PID:4684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12825.exe
        5⤵
        
        PID:5396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50411.exe
        5⤵
        
        PID:6036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27538.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27538.exe
      4⤵
      PID:2596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54201.exe
        5⤵
        
        PID:1768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26790.exe
        5⤵
        
        PID:3764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11979.exe
        5⤵
        
        PID:4304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38180.exe
        5⤵
        
        PID:4968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4339.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22494.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22494.exe
      4⤵
      PID:2764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21190.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21190.exe
      4⤵
      PID:3536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28236.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28236.exe
      4⤵
      PID:4032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8514.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8514.exe
      4⤵
      PID:4436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27709.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27709.exe
      4⤵
      PID:5832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61469.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61469.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18720.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18720.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54559.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54559.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62893.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59058.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8569.exe
        7⤵
        
        PID:3012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45810.exe
        7⤵
        
        PID:3836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27085.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-374.exe
        7⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14876.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50179.exe
        6⤵
        
        PID:1760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51963.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42943.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20867.exe
        7⤵
        
        PID:6948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40526.exe
        6⤵
        
        PID:3636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21928.exe
        6⤵
        
        PID:4260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29514.exe
        6⤵
        
        PID:4932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10265.exe
        6⤵
        
        PID:6108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18597.exe
        6⤵
        
        PID:7008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22664.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23251.exe
        6⤵
        
        PID:2008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10858.exe
        6⤵
        
        PID:3168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4360.exe
        6⤵
        
        PID:4280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24522.exe
        6⤵
        
        PID:5976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8569.exe
        5⤵
        
        PID:1484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45810.exe
        5⤵
        
        PID:3436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14833.exe
        5⤵
        
        PID:4792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61827.exe
        5⤵
        
        PID:5448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10087.exe
        5⤵
        
        PID:6388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1995.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1995.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38446.exe
        5⤵
        Executes dropped EXE
        
        PID:2032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40526.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36371.exe
        6⤵
        
        PID:3044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29514.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50185.exe
        6⤵
        
        PID:5792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60371.exe
        5⤵
        
        PID:2184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39945.exe
        5⤵
        
        PID:3440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35751.exe
        5⤵
        
        PID:4960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12825.exe
        5⤵
        
        PID:5344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59648.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20255.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20255.exe
      4⤵
      PID:1240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38846.exe
        5⤵
        
        PID:2708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26209.exe
        5⤵
        
        PID:3952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6341.exe
        5⤵
        
        PID:5044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13322.exe
        5⤵
        
        PID:5168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14346.exe
        5⤵
        
        PID:5840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14434.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37144.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37144.exe
      4⤵
      PID:3920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63835.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63835.exe
      4⤵
      PID:4700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13355.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13355.exe
      4⤵
      PID:5388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45945.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45945.exe
      4⤵
      PID:5996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49306.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49306.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55685.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22302.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49925.exe
        6⤵
        
        PID:1592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26790.exe
        6⤵
        
        PID:3688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30505.exe
        6⤵
        
        PID:3252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38180.exe
        6⤵
        
        PID:4648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37203.exe
        6⤵
        
        PID:5684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26167.exe
        5⤵
        
        PID:2224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40526.exe
        5⤵
        
        PID:3620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36371.exe
        5⤵
        
        PID:1688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29514.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21404.exe
        5⤵
        
        PID:5948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59421.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59421.exe
      4⤵
      PID:1884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23251.exe
        5⤵
        
        PID:1140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10858.exe
        5⤵
        
        PID:4052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9767.exe
        5⤵
        
        PID:4812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24522.exe
        5⤵
        
        PID:5952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8569.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8569.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45810.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45810.exe
      4⤵
      PID:3740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55496.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55496.exe
      4⤵
      PID:4488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49941.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49941.exe
      4⤵
      PID:5756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6750.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6750.exe
      4⤵
      PID:6348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43360.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43360.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34554.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34554.exe
      4⤵
      PID:704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54201.exe
        5⤵
        
        PID:2992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26790.exe
        5⤵
        
        PID:3796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11979.exe
        5⤵
        
        PID:4296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38180.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57636.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14683.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14683.exe
      4⤵
      PID:348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40526.exe
      4⤵
      PID:3464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3506.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3506.exe
      4⤵
      PID:4136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29514.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29514.exe
      4⤵
      PID:4640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41100.exe
      4⤵
      PID:5340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18597.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18597.exe
      4⤵
      PID:6984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58104.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58104.exe
    3⤵
    PID:2472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-916.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-916.exe
      4⤵
      PID:856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26790.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26790.exe
      4⤵
      PID:3656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16063.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16063.exe
      4⤵
      PID:4244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38180.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38180.exe
      4⤵
      PID:4180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37203.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37203.exe
      4⤵
      PID:5660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3868.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3868.exe
    3⤵
    PID:2820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38256.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38256.exe
    3⤵
    PID:3544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43461.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43461.exe
    3⤵
    PID:4128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3179.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3179.exe
    3⤵
    PID:4428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35500.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35500.exe
    3⤵
    PID:4112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33733.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33733.exe
    3⤵
    PID:7092
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61947.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61947.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42670.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42670.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55436.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6676.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55898.exe
        6⤵
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54964.exe
        7⤵
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10858.exe
        7⤵
        
        PID:4060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58968.exe
        7⤵
        
        PID:3936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20246.exe
        7⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48931.exe
        7⤵
        
        PID:6468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23251.exe
        6⤵
        
        PID:1752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8795.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61827.exe
        6⤵
        
        PID:5380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1939.exe
        6⤵
        
        PID:5240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57526.exe
        5⤵
        
        PID:2936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46391.exe
        5⤵
        
        PID:3576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27705.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12979.exe
        5⤵
        
        PID:4356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4881.exe
        5⤵
        
        PID:5556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62604.exe
        5⤵
        
        PID:7164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2571.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55706.exe
        5⤵
        
        PID:2140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40526.exe
        6⤵
        
        PID:3456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36371.exe
        6⤵
        
        PID:3052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29514.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54269.exe
        6⤵
        
        PID:5088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60371.exe
        5⤵
        
        PID:576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39945.exe
        5⤵
        
        PID:3732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35751.exe
        5⤵
        
        PID:4924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16909.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63348.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54921.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54921.exe
      4⤵
      PID:2440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10823.exe
        5⤵
        
        PID:3212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3898.exe
        5⤵
        
        PID:4676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27877.exe
        5⤵
        
        PID:5616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35456.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42852.exe
      4⤵
      PID:2880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8058.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8058.exe
      4⤵
      PID:2996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54188.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54188.exe
      4⤵
      PID:4652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33029.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33029.exe
      4⤵
      PID:5928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15686.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15686.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39737.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39737.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6676.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6676.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26002.exe
        5⤵
        
        PID:1792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63656.exe
        6⤵
        
        PID:2840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26790.exe
        6⤵
        
        PID:3744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30505.exe
        6⤵
        
        PID:3400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38180.exe
        6⤵
        
        PID:4644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57636.exe
        6⤵
        
        PID:5404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16354.exe
        5⤵
        
        PID:2644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40526.exe
        5⤵
        
        PID:3628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36371.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29514.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53353.exe
        5⤵
        
        PID:5568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18597.exe
        5⤵
        
        PID:6968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23588.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23588.exe
      4⤵
      PID:940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14699.exe
        5⤵
        
        PID:3000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10858.exe
        5⤵
        
        PID:3200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9767.exe
        5⤵
        
        PID:4820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24522.exe
        5⤵
        
        PID:5968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8569.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8569.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45810.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45810.exe
      4⤵
      PID:3844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27085.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27085.exe
      4⤵
      PID:4980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54043.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54043.exe
      4⤵
      PID:4192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43657.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43657.exe
      4⤵
      PID:5748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45087.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45087.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55706.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51456.exe
        5⤵
        
        PID:1560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26209.exe
        5⤵
        
        PID:3944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29885.exe
        5⤵
        
        PID:5008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13322.exe
        5⤵
        
        PID:5224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14346.exe
        5⤵
        
        PID:5936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35098.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35098.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39945.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39945.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35751.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35751.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25077.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25077.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10255.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10255.exe
      4⤵
      PID:6232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35213.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35213.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14699.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14699.exe
      4⤵
      PID:2848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26209.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26209.exe
      4⤵
      PID:3976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29885.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29885.exe
      4⤵
      PID:4884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13706.exe
      4⤵
      PID:4856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14346.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14346.exe
      4⤵
      PID:5856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5769.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5769.exe
    3⤵
    PID:2256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20609.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20609.exe
    3⤵
    PID:3444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15363.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15363.exe
    3⤵
    PID:4752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57361.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57361.exe
    3⤵
    PID:5496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49847.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49847.exe
    3⤵
    PID:5236
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34429.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34429.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23916.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23916.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45654.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45654.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35452.exe
        5⤵
        
        PID:1660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40526.exe
        5⤵
        
        PID:3592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21928.exe
        5⤵
        
        PID:4252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29514.exe
        5⤵
        
        PID:4840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53353.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18597.exe
        5⤵
        
        PID:7044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43791.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43791.exe
      4⤵
      PID:2340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40526.exe
      4⤵
      PID:3568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36371.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36371.exe
      4⤵
      PID:2576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29514.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29514.exe
      4⤵
      PID:4212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53353.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53353.exe
      4⤵
      PID:6136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18597.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18597.exe
      4⤵
      PID:7028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62545.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62545.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63656.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63656.exe
      4⤵
      PID:2716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26790.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26790.exe
      4⤵
      PID:3756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23499.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23499.exe
      4⤵
      PID:4784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16909.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16909.exe
      4⤵
      PID:5200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63348.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63348.exe
      4⤵
      PID:5636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49550.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49550.exe
    3⤵
    PID:2904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57101.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57101.exe
      4⤵
      PID:6404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46391.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46391.exe
    3⤵
    PID:3520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64462.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64462.exe
    3⤵
    PID:4120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12979.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12979.exe
    3⤵
    PID:4400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54575.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54575.exe
    3⤵
    PID:5796
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39490.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39490.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60345.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60345.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8569.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8569.exe
      4⤵
      PID:3060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45810.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45810.exe
      4⤵
      PID:3804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14833.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14833.exe
      4⤵
      PID:4716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8005.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8005.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62604.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62604.exe
      4⤵
      PID:6204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23203.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23203.exe
    3⤵
    PID:2908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46391.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46391.exe
    3⤵
    PID:3512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13263.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13263.exe
    3⤵
    PID:4204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12979.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12979.exe
    3⤵
    PID:4340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32738.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32738.exe
    3⤵
    PID:5724
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49160.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49160.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23251.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23251.exe
    3⤵
    PID:1632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10858.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10858.exe
    3⤵
    PID:3220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33395.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33395.exe
    3⤵
    PID:4416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8236.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8236.exe
    3⤵
    PID:5880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18597.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18597.exe
    3⤵
    PID:7056
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6299.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6299.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2696
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16144.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16144.exe
  2⤵
  PID:3856
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54034.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54034.exe
  2⤵
  PID:4692
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56227.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56227.exe
  2⤵
  PID:5408
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17075.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17075.exe
  2⤵
  PID:6008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-18720.exe

Filesize
468KB

MD5
df815cd6114fc81a76dfc38623e37523

SHA1
29a23b5bae967f3cd53daf8e7ad62f474c3a803a

SHA256
56d9a5e7c21973257512a12ad4144ab7b8c280cf024dfb7f97a4c42e8b44464f

SHA512
d2b224ee7aa8016f7ce8b81817ee54e5b28331663c098c05b57fd5dcdc87019ad69c1274253e902a31dcb2fea412e9ceff1e0e162a29e8493ce51b1287b84ef1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3445.exe

Filesize
468KB

MD5
b64d7c3b1e82a923dd0b9732f2798d62

SHA1
df801bcf11cd3983292313039ef2dabf4edb0bae

SHA256
4239427cec5664332f62625490dd3f7fb91c12a1af3f86079c0b14e2e339a73a

SHA512
1bb17ce613bc3b4e98345c7e2163a13e18b8ccf5ef7230bae0d5f6e621a6fd833eff51c4fe1e03745863d3e3c6928f30d38eaf56e87511817f62e989fcfb3f72

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39737.exe

Filesize
468KB

MD5
356c0c2bebe352a64e1edefa12321b83

SHA1
d6a84b27d6677533a46a207b75e44ba5c2b01997

SHA256
8f141696f91c273d6df0b2b2a7d1ea95c23df61ffa1505e68f6bc30275de17cf

SHA512
21dfb675a0b44647a056b6d5d7852b7839d553a4f7349959c966b75500bc2dae4c36d1321a5b282d9f25b6c155ec4f2878d6fa594a01a851bb774ccfab33bcaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52182.exe

Filesize
468KB

MD5
b61e77df1bf3dc10f26cab114c84e6f4

SHA1
dacebe3d8d2f3a64dc9933fc93f45d213ed0b048

SHA256
ebec01a50c791986c9c1112a724c9d158983ea85de9a7818ff098421f06f3a0c

SHA512
6d7a11d1dba23b5d963bc2fd5d41c076020a59f12be7ec93491966763cced82f2f03878bde66eeecaacd9284a422b190eee417da37677eba3962f10f8e8e0fad

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56266.exe

Filesize
468KB

MD5
4b187aae2e3e88bc8a2b23012ffa12d3

SHA1
21bff3c12d715c9ffea164ebb0e866d6bcae2108

SHA256
a76f9015563044218b92b3b03ed07e1d2ca0c437932ff0fb0ba5a07c2f89fa21

SHA512
595afc8e6213ddc9ec6ea47d4f819ade2ede592433a8a9ac9e999c426d2d0d2e1f7e163239413e65227c0281637c80d0c3d54b23c9ccad3cc6d25d8cce4b9bed

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-18877.exe

Filesize
468KB

MD5
897fd5b6df88537c96d6d0db97aa4db6

SHA1
41892b0f474f678060d96e7ef6c10c681daa5485

SHA256
0de814ba1632cdc92381ee33a250b12410d451b9ee0df245b74f280f7f3b1c12

SHA512
07cacb912623700e4a4f8b22bc3545c9643953987e959162d147021b0cd0e1057507124187e61143aea159cbf45125e22f082f02844dba4cbf33467168f1ef93

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-23311.exe

Filesize
468KB

MD5
2f5a50a706cb027bb82e6e50d33686eb

SHA1
0d5068f95418eb286506f89e7032cb6b1a9d0c15

SHA256
ff545d5f07b60beb51bd06d3e976b5793a13a5dfa2ae4bb6165791e82dd9c64a

SHA512
e199688533d024c5740c34fee040997ec4d5254bd199381e6cb9e0ff2bc9a49223684548d181c5599d67d770e1481d6bcf4e65853f09d7405df057688b5e48a3

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-23537.exe

Filesize
468KB

MD5
5ca8a15dc06d6397625f1739ec46db66

SHA1
ad4d73d2535470912b5ece491f461c69915a0acb

SHA256
ef2208978c98ec6faa402c991f4833846c38443baadca133ebc7e846e0781e56

SHA512
9c51587a350818622938a0d4bb751d459613bb03f06ab33f86a8b806acec699032e9795e7d19592016862786f2799689f312ded2d690ea4d4b3c5f8b4b920425

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-27229.exe

Filesize
468KB

MD5
c8ac854ba1e14cc75fab5c280b239443

SHA1
5890b908c82aa3f88e314b601c488c56b39833b6

SHA256
3617fe203afe859f735a909c272b35aeaf2f43214ec71f393962ffde0adf0ab2

SHA512
7a4b79744f9848aa88287ae2b83ef9f24e6a636bf7c04f919a9b9e59ea68ba5c433f8021e4791974d0f7c00952c90c3acc0b731bee304c424afbc87ec8dd37b1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-34429.exe

Filesize
468KB

MD5
37baee902af21f769124f29d82651418

SHA1
04ced06dace1cf7e22134056eaaa7412eec092b8

SHA256
107fa8ecf18e946ba137924d8232923886e55d2fa85ff96dec1c7265a2d1f9bf

SHA512
8cf37353b2fd90186802de1f3e08b616079ce92d2e5b88b799a005b35bda5a1d9266fd0406b8f843641084b498f87c6b4e1d688736f80be6d1fe01e1985bd661

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-42670.exe

Filesize
468KB

MD5
b7e77c16b1c309820017998045e01e46

SHA1
b85687e5761a7ad15f9117db42c343eeb00353c2

SHA256
2f28908ada11a973fd905f7e662fc46bbe14cb58fba2d984fc123fc3b7641e4f

SHA512
40447a7a9db31f11dc835cc4c9809cb682f7afe3deaf36bf8ee509645e85b5b371773d2e8f6aafda3c7ee550610b4362798ebf57b508b8ff1f448b9dcee4d622

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-48845.exe

Filesize
468KB

MD5
c383ede88ca948c4f40d59635e3cde5c

SHA1
e12dfbc15341d93162f03342e54cc56647a65dd5

SHA256
daa0975d3292e5bd4efeab8dd6cf23933ba31ca6f6c1974b2e5e5b457784cf63

SHA512
0b0b6572787ca83549fc5f9055cc797bb030027dfa74b6faa7543d797ec9f25d349481f70a4f5d7ce64ca0405854a20449aa4bb303878a445098ae2d969fa262

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-49306.exe

Filesize
468KB

MD5
7ffd8414131430806e8d9b14f07cbbb5

SHA1
76a52712421b189fb3c036f6addefe042ea06026

SHA256
9942ac045f3e0d621945fed3026a1da9a5d24c5022aedbc282b7ecdbbe39a1ec

SHA512
02bf336a721eb6ac844647f1dfce98024fb09ba1dceb5b2dd1da7d7d793a0c3cf26804a21d0fb21ed919a6f8f23e2ad3d1df56d125a7d9d8b87fbd31ae0083c2

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-54559.exe

Filesize
468KB

MD5
1409101cc5679a6ce12741c51ed60506

SHA1
f1b58c69bbebce5b2ad6c0616394726da3bfab15

SHA256
071256375c88f5b89a7b9df703ec8c7024f049f1cd7ce62d4b6e408136ce3936

SHA512
3f43594e4ad8221ffacf2d6d03b26479cb787ceb817874091ebd8ff3afd5e3b5e75ab6c033f5861be2290b45f0c5397f00384b3b34d4f2917039332bc1ffe734

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-55436.exe

Filesize
468KB

MD5
176997e499d1358723132e096026257d

SHA1
bba9f6c748fb291c364b6ce084fdfd2b90f6d686

SHA256
2a828c5630763c964d8ce3640ccfbd09cf20c372b09f1fb7095f5c5a83bf22f2

SHA512
81dae9c165d2c0c69878cc3484b301ffd3764f7407e89e021f97aa6202a14216b40e6fb050a7111c50f7585ceabac94ea567e95ac25a2ae1c9f41bca796fa7eb

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-61947.exe

Filesize
468KB

MD5
fe0fd4c5fdfa38953fbebcb3a73ffcd3

SHA1
e47457d17f0b3644ac800e0ac5aed5f9e9655c7e

SHA256
0b8dd3df3abad5eda2b45e32693565c6d0a77225c778664c3c0d7541f8156e85

SHA512
90954cc6cbe2ac58f873497291d444a7fe76cb3e2c938c3375b4324d629c2dc0e605134b3e78179b7b35cbb368cd5f944e2bc6801ec8ad5be250b49b897ec153

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-62580.exe

Filesize
468KB

MD5
ac0b388ef4aaee13df2bd68e56da132a

SHA1
e10e2ee26ed4ab11cd0a02e30516df8e7bacfe39

SHA256
a3ae8602aa96861f2e51b3de793daa497217816cdc747911800e69819838015e

SHA512
fefd68ff121889e41b00ca41a7663158d1677e4e3f8ff9efd079790cd766036a43a286f1253c342e69595c44bdbd12401aae48e392d6039621ce8594fab899eb

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-64548.exe

Filesize
468KB

MD5
700221959d80b44fe4bec1cbd4bfa697

SHA1
832577186580cc360324e1913dcac73a17d6aa32

SHA256
6ad80197f0ea1137fc0d8e1290cb0468e4a82da7e33bb5dd0cc50b1884f22f8b

SHA512
4dd7f80070e5846b11b9fe3b3ccebc4fe65834c8b2004883d515520cfa087905ec873405e374967aa03e514712471b904008208bbb800a7f9d0d87acf036d72f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-9997.exe

Filesize
468KB

MD5
99f5482d057d0599f537ffb796662398

SHA1
721faa74fd21bd1bcda9aeefebb64575b3716534

SHA256
0afa4b48241ff5bb2d8276124a523a08b1df4d53068965a829582c65f1f665fa

SHA512
1a5c11e9e50168d3a7712076e03e8e917fb8126163fe6fa8821930908c949308384df7618de03eb73fa103e895321364753a7cedaf06b2f5ddc73c1e71d6020b

Download Submit
memory/108-303-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/320-109-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/320-199-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/320-377-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/320-200-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/560-275-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/700-282-0x0000000000650000-0x00000000006C5000-memory.dmp

Filesize
468KB

Download
memory/700-157-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/700-278-0x0000000000650000-0x00000000006C5000-memory.dmp

Filesize
468KB

Download
memory/888-297-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/920-202-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/920-367-0x0000000002000000-0x0000000002075000-memory.dmp

Filesize
468KB

Download
memory/920-366-0x0000000002B30000-0x0000000002BA5000-memory.dmp

Filesize
468KB

Download
memory/1056-407-0x0000000003460000-0x00000000034D5000-memory.dmp

Filesize
468KB

Download
memory/1056-405-0x0000000003460000-0x00000000034D5000-memory.dmp

Filesize
468KB

Download
memory/1056-229-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1120-398-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1340-221-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1340-386-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1616-236-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1616-237-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1616-60-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1712-316-0x00000000024D0000-0x0000000002545000-memory.dmp

Filesize
468KB

Download
memory/1712-185-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1776-250-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1944-268-0x00000000024C0000-0x0000000002535000-memory.dmp

Filesize
468KB

Download
memory/1944-262-0x00000000024C0000-0x0000000002535000-memory.dmp

Filesize
468KB

Download
memory/1944-99-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1996-160-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1996-306-0x00000000024F0000-0x0000000002565000-memory.dmp

Filesize
468KB

Download
memory/1996-307-0x00000000024F0000-0x0000000002565000-memory.dmp

Filesize
468KB

Download
memory/2052-284-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2164-216-0x0000000002740000-0x00000000027B5000-memory.dmp

Filesize
468KB

Download
memory/2164-397-0x0000000002740000-0x00000000027B5000-memory.dmp

Filesize
468KB

Download
memory/2164-215-0x0000000002740000-0x00000000027B5000-memory.dmp

Filesize
468KB

Download
memory/2164-409-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2164-396-0x0000000002740000-0x00000000027B5000-memory.dmp

Filesize
468KB

Download
memory/2164-29-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2236-182-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2236-344-0x0000000001CC0000-0x0000000001D35000-memory.dmp

Filesize
468KB

Download
memory/2236-343-0x0000000001CC0000-0x0000000001D35000-memory.dmp

Filesize
468KB

Download
memory/2284-378-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2468-184-0x0000000002680000-0x00000000026F5000-memory.dmp

Filesize
468KB

Download
memory/2468-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2468-387-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2468-180-0x0000000002680000-0x00000000026F5000-memory.dmp

Filesize
468KB

Download
memory/2468-81-0x0000000002680000-0x00000000026F5000-memory.dmp

Filesize
468KB

Download
memory/2468-342-0x0000000002680000-0x00000000026F5000-memory.dmp

Filesize
468KB

Download
memory/2492-346-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2524-259-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2524-258-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2524-376-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2524-26-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2524-6-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2524-12-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2524-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2524-133-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2612-368-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2648-155-0x00000000033B0000-0x0000000003425000-memory.dmp

Filesize
468KB

Download
memory/2648-290-0x0000000002880000-0x00000000028F5000-memory.dmp

Filesize
468KB

Download
memory/2648-144-0x00000000033B0000-0x0000000003425000-memory.dmp

Filesize
468KB

Download
memory/2648-291-0x0000000002880000-0x00000000028F5000-memory.dmp

Filesize
468KB

Download
memory/2648-74-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2680-323-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2712-83-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2712-158-0x0000000001CD0000-0x0000000001D45000-memory.dmp

Filesize
468KB

Download
memory/2712-329-0x0000000001CD0000-0x0000000001D45000-memory.dmp

Filesize
468KB

Download
memory/2712-334-0x0000000001CD0000-0x0000000001D45000-memory.dmp

Filesize
468KB

Download
memory/2712-156-0x0000000001CD0000-0x0000000001D45000-memory.dmp

Filesize
468KB

Download
memory/2740-348-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2796-349-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2800-350-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2804-37-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2804-73-0x0000000001D90000-0x0000000001E05000-memory.dmp

Filesize
468KB

Download
memory/2804-335-0x0000000001D90000-0x0000000001E05000-memory.dmp

Filesize
468KB

Download
memory/2804-179-0x0000000001D90000-0x0000000001E05000-memory.dmp

Filesize
468KB

Download
memory/2804-345-0x0000000001D90000-0x0000000001E05000-memory.dmp

Filesize
468KB

Download
memory/2804-183-0x0000000001D90000-0x0000000001E05000-memory.dmp

Filesize
468KB

Download
memory/2824-96-0x0000000002550000-0x00000000025C5000-memory.dmp

Filesize
468KB

Download
memory/2824-276-0x0000000002550000-0x00000000025C5000-memory.dmp

Filesize
468KB

Download
memory/2824-274-0x0000000002550000-0x00000000025C5000-memory.dmp

Filesize
468KB

Download
memory/2824-49-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2824-97-0x0000000002550000-0x00000000025C5000-memory.dmp

Filesize
468KB

Download
memory/2892-388-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2912-248-0x0000000001D70000-0x0000000001DE5000-memory.dmp

Filesize
468KB

Download
memory/2912-249-0x0000000001D70000-0x0000000001DE5000-memory.dmp

Filesize
468KB

Download
memory/2912-134-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2940-408-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2952-122-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2952-228-0x00000000023A0000-0x0000000002415000-memory.dmp

Filesize
468KB

Download
memory/2952-230-0x00000000023A0000-0x0000000002415000-memory.dmp

Filesize
468KB

Download
memory/2976-260-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3028-238-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3028-406-0x0000000001F80000-0x0000000001FF5000-memory.dmp

Filesize
468KB

Download
memory/3028-404-0x0000000001F80000-0x0000000001FF5000-memory.dmp

Filesize
468KB

Download
memory/3036-269-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download